Between late September and early October 2026, a coordinated intrusion against seven South Korean financial entities exposed personal, employment, financial, and credit data of between 66,000 and 67,000 citizens and nearly 2,200 companies. Cybersecurity firm Hunt.io has detailed the infrastructure and automated exploitation mechanisms used in the incident, complementing initial findings published by CrowdStrike on October 7 and Genians Security Center on October 12, 2026.
Technical reports agree in attributing the unauthorized access to the use of ARTEX, an open-source autonomous penetration testing environment created in China under an AGPL-3.0 license. According to CrowdStrike assessments with a moderate confidence level, the perpetrator of the intrusions does not belong to a structured cyber-espionage group, but is an individual Chinese-speaking operator motivated by direct economic incentive.
Engineering on Claude Code to execute external models
Hunt.io located a unique adaptation of Claude Code, Anthropic's official command-line tool, in version 2.1.221 on the campaign servers. Although this software was executed 510 times since August 4, 2026, logs show the system did not connect to Anthropic's servers. The operator redirected requests via the Claude Code Router intermediary toward DeepSeek infrastructure.
To bypass network incompatibilities, the attacker implemented a local proxy called ds-models-shim.py. This script intercepted queries to the official /v1/models access point, which returned a 404 error code when not operating with Anthropic, and spoofed a list of compatible models to force redirection to api.deepseek.com/anthropic. A second script, called xcai-effort-shim.py, added instructions to ensure the DeepSeek v4.1 Flash model executed its reasoning cycles, supported by GLM 5.3 and Grok 4.6 as backup models acquired through the xcai[.]pro intermediary.
Custom skills and manipulation of banking services
The attack environment featured 19 reusable instruction modules, defined as agent skills, which accumulated 147 recorded executions. These functions included utilities for source code auditing, passive reconnaissance, web application firewall (WAF) evasion, Telegram mini-app inspection, APK package decompilation for Android devices, and logic testing against payment gateways.
Alongside the payment module instructions, analysts discovered three test accounts created on September 12, 2026, with valid credentials for a cash deposit interface. These tools served to exploit insecure direct object reference flaws, an access control vulnerability that allows manipulating identifiers to query or modify third-party information. CrowdStrike and Genians confirmed that this exact technique allowed the compromise of bank loan inquiry services at the South Korean entities.
Infrastructure exposed between Los Angeles and Hong Kong
The operational architecture relied on two main servers exposed without basic isolation. The first node, located at 38.244.50.120 within the Cogent network in Los Angeles, maintained 15 open ports and hosted the ARTEX web console on ports 443 and 8090, in addition to a Tinyproxy server and a Gemini2API panel.
The second server, located in Hong Kong at 23.248.226.250 under autonomous system AS138415, functioned as a jump node and contained an open directory with 42 files and 105 megabytes of information. Hunt.io's AttackCapture platform had registered alerts on this machine on September 5 and 26 and October 5, 2026. Among the unprotected files were access keys for Zhipu AI's GLM models and reverse SSH tunnel configurations that channeled traffic toward a network of rotating proxies with 79 distinct outbound IP addresses.
Global distribution of the framework and defensive measures
Although the ARTEX repository on GitHub and its Docker container were removed on October 11, 2026, its distribution continues through independent copies. Searching for digital certificates associated with the project allowed Hunt.io to locate 19 identical IP addresses, while analysis of page titles yielded approximately 1,300 consoles distributed across 30 countries, led by the United States, China, and Hong Kong. The active interfaces featured adaptations in seven languages: English, Chinese, Korean, Japanese, Russian, Portuguese, and Vietnamese.
Analysis of another 280 ARTEX servers with open directories led to the discovery of utilities aimed at compromising DedeCMS, FangCMS, and RuoYi content managers, as well as tools to bypass CAPTCHA verification systems. To mitigate this threat, specialists recommend restricting administrative consoles behind virtual private networks, immediately revoking exposed API credentials, and monitoring remote queries over LDAP protocols and JNDI directory interfaces.
Likewise, Hunt.io advises defenders to restrict access to gateways toward language models, supervise their requests, and apply compliance rules on managed devices, warning that an investigation should not stop at the first list of indicators of compromise.
