IP Intelligence Exposes China-Linked Campaign Targeting South Korea's Financial Sector

Computer security experts face far more dangerous threats to data breaches: Artificial Intelligence.

CrowdStrike Intelligence recently detected a cyberattack targeting South Korean financial institutions using AI for penetration and threat detection.

The report detailed, “In this activity, the threat actor leveraged ARTEX, a recently released open-source agentic penetration testing (pentesting) tool developed in China, alongside large language models (LLMs).” While details about the attacker’s personal information are sparse, the attacker is most likely a Chinese speaker with financial goals.

ARTEX and LLM Tools

A curious detail about this type of attack is that it’s mostly done with an open-source tool and multiple LLMs. ARTEX is an open-source tool previously available on GitHub. According to Avoid.net, the tool “is an open-source, LLM-orchestrating agentic penetration-testing tool published on GitHub on July 26, 2026 by a Chinese developer using the alias 'Autumn' (identified in reporting as Li Puhua).” The official GitHub page is no longer available as of this writing. The main IP Address used in the attack was 38.244.50.120. Investigators also found other IP addresses used to route the attack through proxy servers.

While the tool itself is not illegal and is actually very useful for security testing, the attacker repurposed ARTEX to penetrate financial institutions in South Korea. For those interested, GitHub still has numerous tools similar to ARTEX, some of them with the same name.

The attack used multiple large language models (LLMs), with DeepSeek V4.1-Flash as the primary model, supported by GLM-5.3 from Zhipu AI and Grok 4.6. The attack also uses Claude for other tasks, such as finding Telegram pages interested in the acquired data, according to Infosecurity Magazine.

Speed and Purpose of the Attack

The use of open-source tools and available LLMs poses a real cybersecurity threat. Although these attacks still require technical knowledge, AI has lowered the barrier to entry. In this case, the attacker used a hosted IP address to run ARTEX and target sensitive data in South Korea. With AI assistance, the tool can also identify errors and adjust its approach with less human input, allowing it to repeat tests until it finds a way to proceed.

Clearly, the attack's purpose is money. No further reports confirm whether the attacker found a buyer for the stolen data, but the amount of information collected could attract interest on the black market. According to Aviatrix, at least seven financial institutions were affected, and more than 65,000 records were compromised. The large volume of compromised records could attract criminals looking to exploit the stolen data for malicious purposes.

Precaution and Prevention

South Korea’s Financial Services Commission issued an advisory regarding the attack. The commission is “urging financial consumers to practice caution over potential phishing attacks and loan scams following recent personal information breaches in the financial sector.”

In light of recent AI-powered attacks, security experts should review and strengthen their security measures to help prevent similar breaches. As AI-powered attacks continue to evolve, organizations must regularly review and strengthen their security measures to stay protected.