Late 2026: Attackers Use ARTEX AI and LLMs to Steal Data From South Korean Banks

A targeted cyber campaign against South Korean financial institutions resulted in significant data theft during the final weeks of September and the beginning of October 2026. Security researchers from CrowdStrike Intelligence disclosed the details of this operation, which leveraged the artificial intelligence-powered penetration testing tool known as ARTEX to execute the attacks. The activity specifically focused on banks and other financial firms within South Korea, leading to the confirmed exfiltration of sensitive organizational data.

What tool did the attackers use to breach these financial systems?

The threat actors utilized ARTEX, an AI-driven penetration testing tool, to carry out the intrusions into South Korean financial networks. According to analysis by CrowdStrike, the attackers combined this specialized software with large language models to automate and enhance their offensive capabilities. This combination allowed the group to identify vulnerabilities and exploit them more efficiently than traditional manual methods might permit.

The use of ARTEX in this context highlights the growing risk of commercial security tools being repurposed for malicious activities. While ARTEX is designed for authorized security testing, the attackers abused its features to gain unauthorized access. CrowdStrike’s research indicates that the tool’s AI capabilities were central to the campaign’s success in breaching these protected environments.

How did the attackers operate and what evidence did they leave behind?

CrowdStrike analysts examined open directories that were left exposed by the attackers during the campaign. These directories contained working notes and other artifacts that revealed how the threat actors used ARTEX and large language models to breach the financial firms. The presence of these notes provided crucial insight into the attackers’ methodology and their reliance on AI assistance throughout the intrusion process.

The campaign remained active from late September to early October 2026, according to CrowdStrike Intelligence. During this period, the threat actors successfully exfiltrated data from the targeted South Korean organizations. The discovery of these open directories and the subsequent analysis by security researchers confirmed the extent of the breach and the specific tools employed by the malicious group.

What are the operational risks for financial organizations using similar tools?

Financial organizations face heightened risks when commercial penetration testing tools like ARTEX are available to threat actors. The ability of attackers to leverage AI-driven tools means that vulnerabilities can be identified and exploited with greater speed and precision. This shifts the burden on defenders to monitor for unusual activity that may indicate the use of automated or AI-assisted attack methods.

The exfiltration of data in this campaign demonstrates the potential operational impact of such breaches. South Korean financial firms experienced direct losses of sensitive information, which can lead to regulatory scrutiny, reputational damage, and financial liability. Organizations must recognize that the same tools used for defensive security assessments can be turned against them by sophisticated adversaries.

What steps should organizations take to mitigate these specific AI-driven threats?

Organizations should immediately review access controls for any penetration testing tools or AI platforms deployed within their environments. Ensuring that these tools are strictly limited to authorized security personnel and monitored for unusual usage patterns is critical. Additionally, companies should audit their network configurations to ensure that no open directories or sensitive data repositories are inadvertently exposed to external networks.

Security teams should also enhance their monitoring for indicators of compromise associated with AI-assisted attacks. This includes looking for automated scanning patterns or unusual data access requests that may signal the use of tools like ARTEX. Regular security assessments and updates to defensive strategies are necessary to counter the evolving threat landscape involving AI-driven penetration testing capabilities.

What to do and how to stay safe: ARTEX

• Audit all access permissions for internal penetration testing tools and AI platforms to ensure only authorized personnel can use them.
• Scan your network for open directories or exposed data repositories that could provide attackers with easy access to sensitive information.
• Monitor network traffic for unusual automated scanning patterns or data exfiltration attempts that may indicate AI-assisted attacks.
• Review incident response plans to include specific procedures for detecting and mitigating breaches involving commercial security tools.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which tool was used in the South Korean financial data theft campaign?

The attackers used ARTEX, an AI-driven penetration testing tool, combined with large language models to breach the systems.

When did this campaign take place?

The campaign was active from late September to early October 2026, according to CrowdStrike Intelligence.

What evidence did CrowdStrike find to confirm the breach?

CrowdStrike analyzed open directories left by the attackers, which contained working notes showing the use of ARTEX and LLMs.