DEV Community

Anoymask
Anoymask

Posted on Edited on

ARTEX: LLM-Integrated Penetration Testing Tool Used to Target South Korean Financial Institutions and Exfiltrate Data

#security #threatintel

1. Basic Information

2. Executive Summary

An unknown threat actor leveraged ARTEX and multiple LLMs to target financial institutions in South Korea. CrowdStrike confirmed evidence of a campaign that led to data exfiltration, based on session history, settings, and memory files found in an open directory on the attacker's infrastructure.

3. Attack Flow

Confirmed Campaign Structure

  1. The attacker managed Claude Code sessions, prompts, and memory on a Hong Kong-based server.
  2. ARTEX was operated on a separate server at 38.244.50[.]120, utilizing LLM backends such as DeepSeek.
  3. Operations targeted South Korean financial institutions. Specific initial access vectors remain unconfirmed.
  4. CrowdStrike reported that the campaign resulted in data exfiltration. The scope of impact on individual organizations is unconfirmed.

4. Attacker Positioning and Execution Location

  • The threat actor targeted Internet-facing services and business systems of financial institutions from external infrastructure. The methods used to obtain initial credentials and privileges have not been disclosed.

5. Visibility for Victims and Administrators

  • Users: May experience service anomalies, unexpected authentication prompts, or unauthorized use of personal and transaction data.
  • Administrators: Observable indicators include external reconnaissance, suspicious proxies, and large-scale data access, downloads, or egress.

6. Conditions for Success and Failure

Success Conditions

  • Reaching the target service and gaining access to internal resources using vulnerabilities or unauthorized credentials.
  • Maintaining the network path between the target and the infrastructure running the ARTEX/LLM tools.

Failure Conditions and Mitigations

  • Reduce the attack surface of externally facing services, apply patches, enforce MFA, apply the principle of least privilege, and implement egress controls.
  • Hunt through historical logs using public infrastructure and session artifacts, and revoke compromised accounts and tokens.

7. Impact of Successful Attacks

  • Data exfiltration from financial institutions.
  • Accelerated reconnaissance and continued attacks driven by AI-assisted workflows.
  • Potential unauthorized access to services for customers and brokers, or employee systems.

8. Observable Logs

The following items are candidates for investigation. ARTEX/LLM API communications and Claude-related files were identified on attacker-controlled infrastructure, and their observation in victim environments has not been publicly reported. These should be checked if evidence from the attacker's infrastructure becomes available; in victim environments, investigations should focus on communications with published IPs, request contents, authentication, data access, and external transmissions.

  • Email: No email vectors specific to this incident have been reported.
  • Proxy / SWG / DNS: In victim environments, check for communications with CrowdStrike-published IPs, request content, and external data transmissions. ARTEX/LLM API traffic should be investigated if evidence from the attacker's infrastructure is obtained.
  • Endpoint / EDR: Check for shells, tools, credential access, data staging, and archive creation originating from web or application processes.
  • Identity / IdP: Check for logins outside normal patterns, service account usage, and changes to tokens, MFA, or permissions. Investigate subsequent usage even if initial access was pre-authentication.
  • SaaS / Cloud: Check cloud WAFs, load balancers, API audits, data access, and large-scale exports.
  • Network: Check for scans against targeted services, proxy-routed connections, large outbound transfers, and communications with endpoints such as 38.244.50[.]120.

9. Attack Success Determination

Confirmed via Public Information

  • Information Theft or Session Compromise Confirmed: CrowdStrike reported that the campaign produced exfiltrated data. However, details regarding individual organizations, datasets, and initial vectors remain unconfirmed.

Criteria for Internal Assessment

  • Subsequent Compromise Confirmed: Do not assume successful secondary compromise based solely on public reporting of targeting or shared infrastructure. Separately verify success in lateral movement or persistence using an organization's own hosts, authentication, and operational logs.
  • Correlate requests, processes, authentication, data access, and external transmissions to distinguish between attack attempts and successes.
  • Do not conclude success based solely on HTTP status codes or single alerts absent from public disclosures.

10. Investigation Playbook

  • Investigation Starting Point: Begin with communications with published infrastructure, anomalous requests to external-facing financial services, and large-scale data access or egress.
  • Initial Verification: Verify target products and versions, external reachability, exposure duration, authentication conditions, and the application timestamps of mitigations and updates.
  • Endpoint and Server Investigation: Check process trees, service logs, file modifications, persistence mechanisms, execution of shells or miners, and outbound communications.
  • Authentication and Cloud Investigation: Check for suspicious accounts, tokens, and API usage, permission modifications, unusual connection sources, and resource access.
  • Subsequent Activity: Track post-initialization credential access, lateral movement, additional downloads, external transmissions, and account creation.
  • Containment: Limit external reachability and attack paths, preserve evidence, and then apply updates, rotate credentials, and terminate malicious processes.
  • Categorization: Separate reconnaissance, attack attempts, initial execution, successful authentication, information theft, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Events: In victim environments, detect communications with published IPs or anomalous bulk exports. Treat ARTEX artifacts and LLM API usage as traces identified on attacker infrastructure.
  • Timeline Correlation: Correlate reconnaissance, authentication/exploits, data access, staging, and egress.
  • Threat Hunting: Search for communications with published infrastructure since late September, unknown proxies, and anomalous authentication, data access, or egress. Investigate Claude/ARTEX files and model API usage if evidence from attacker infrastructure is obtained.
  • Log Limitations: Without prompt history, it is difficult to distinguish between agent-generated commands and manual operations. Prioritize endpoint and network evidence.
  • Priority Mitigations: Prioritize patching external services, enforcing MFA, applying least privilege for service accounts, implementing egress controls, and monitoring exports.

12. Facts, Inferences, and Hypotheses

Facts

  • CrowdStrike identified infrastructure associated with a campaign targeting South Korean financial institutions and reported that it led to data exfiltration.
  • 38.244.50[.]120 hosted an ARTEX instance and an open directory, while another Hong Kong-based IP exposed Claude Code session histories, ARTEX configuration settings, and Claude memory files.
  • Session histories revealed a two-server architecture using the Hong Kong-based server as the primary infrastructure and 38.244.50[.]120 as the ARTEX server.
  • ARTEX primarily utilized DeepSeek v4.1-flash as a backend, with GLM-5.3 and Grok 4.6 also used in additional sessions.
  • CrowdStrike assessed with moderate confidence, based on Chinese-language prompts and other indicators, that the actor is likely a Chinese-speaking financially motivated group. This is not an attribution to a named actor.
  • Compromises of individual bank loan inquiry services and mobile work support systems stem from industry reporting, and CrowdStrike did not state that it independently verified all details.

Inferences

  • Preserving tool sessions, memory, prompts, and operator infrastructure within the same case makes it easier to reconstruct the boundary between manual operations and LLM-assisted actions.
  • Because operations can switch across multiple models, relying solely on abuse controls from a single provider will not stop the overall activity. Detections must focus on network, identity, and endpoint evidence.

Hypotheses

  • No additional hypotheses. Unconfirmed items are listed in "14. Unresolved Questions and Further Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1588.007 Obtain Capabilities: Artificial Intelligence High Utilized ARTEX and multiple LLMs in offensive operations.
T1090 Proxy Medium CrowdStrike presented proxy infrastructure overlapping with the campaign. The scope of use in each intrusion phase remains unconfirmed.

14. Unresolved Questions and Further Investigation

  • The exact number of impacted financial institutions, initial intrusion vectors for each organization, dwell times, and acquired data.
  • The boundary between actions autonomously executed by ARTEX and those directly instructed or executed by operators.
  • Confirmed group attribution for the attacker and additional attribution bases beyond Chinese-language prompts.

15. Impact on SOCs and Organizations

Following this incident targeting South Korean financial institutions, financial institutions and broker services operating similar externally facing applications or business-support mobile systems should re-verify their defensive postures. Rather than relying solely on AI tool names or model providers as detection criteria, monitor external reconnaissance, authentication, data access, and exfiltration as a continuous chain of events. If evidence from attacker infrastructure is obtained, preserve agent sessions, memory, and prompts as well.

16. Summary by Target Audience

  • For SOCs: Correlate published infrastructure, continuous operations against external-facing services, data staging, and egress. Check ARTEX-related files if evidence from attacker infrastructure is obtained.
  • For Administrators: Verify inventories of externally facing financial services and business support systems, MFA, service accounts, egress controls, and sensitive data access.
  • For Users: Report unexpected authentication prompts or business system anomalies, and do not approve unverified MFA requests.

Top comments (0)