Chinese-Linked Threat Actor Deploys AI

CrowdStrike Intelligence uncovered a financially motivated threat actor using the Chinese-developed agentic penetration testing tool ARTEX alongside multiple large language models to breach South Korean financial institutions in late September and early October 2026.

A previously unknown threat actor compromised multiple South Korean financial organizations in late September and early October 2026, exfiltrating data through a campaign that combined a Chinese open-source agentic penetration testing tool with multiple large language models, according to CrowdStrike Intelligence.

The campaign leveraged ARTEX, a recently released agentic pentesting framework developed in China, running on infrastructure hosted at IP address 38.244.50.120. CrowdStrike analysts discovered open directories on a Hong Kong-based command server containing Claude Code session histories, ARTEX configuration files, and Claude memory files that documented the operation from late September through early October.

The threat actor used DeepSeek v4.1-flash as the primary LLM backend, supplemented by Zhipu AI's GLM-5.3 and xAI's Grok 4.6 for additional Claude Code sessions. DeepSeek access was likely routed through the API proxy xcai.pro. Nine proxy IP addresses across multiple countries were identified in the Claude Code sessions.

Industry reporting from The Korea Economic Daily confirmed breaches at several South Korean banks beginning in late September. At one institution, the attacker compromised a loan progress inquiry service used by financial brokers. At another, an employee mobile work-support system was breached. The total number of affected organizations remains unconfirmed, though reporting indicates overlapping IP addresses across multiple victims.

CrowdStrike assesses with moderate confidence that the threat actor is a Chinese speaker motivated by financial gain. This assessment rests on the use of the Chinese-developed ARTEX tool and Chinese-language prompts observed in the Claude Code sessions.

In one session, the operator asked Claude to create a security researcher résumé that included bullet points describing the ARTEX campaign results. The prompt contained personal details: name "YY," phone number 17820191556, Telegram handle @YY520CN, age 26, education at South China University of Technology, and location in Maoming, Guangdong. The same Telegram handle appeared in separate Claude Code sessions researching a Telegram-based NFT gift marketplace and targeting a possible Chinese payment platform.

While these details likely belong to the operator, CrowdStrike cannot definitively link them to the ARTEX campaign.

The operation demonstrates how agentic AI tooling can accelerate intrusion timelines. The threat actor conducted multiple intrusions within a short window, using AI to automate reconnaissance, vulnerability research, and exploitation tasks that traditionally require significant manual effort.

CrowdStrike Intelligence assesses that adversaries will continue experimenting with AI tooling to increase operational tempo and capabilities. The campaign maps to MITRE ATT&CK techniques including T1583.003 (Acquire Infrastructure: Virtual Private Server), T1588.007 (Obtain Capabilities: Artificial Intelligence), and T1090 (Proxy).

Indicators of compromise include the ARTEX hosting IP 38.244.50.120 and nine proxy addresses: 101.53.80.20, 205.214.59.31, 124.155.252.63, 154.201.79.246, 23.248.249.90, 23.158.220.98, 103.248.148.84, 203.160.133.172, and 209.209.85.38.

The full CrowdStrike 2026 Global Threat Report examines the broader shift toward AI-enabled adversary tradecraft and is available for download from the CrowdStrike website .

Source : crowdstrike.com