Campaign with LLM and ARTEX attacks South Korean financial institutions and exfilters data

Security researchers have documented a campaign directed against South Korean financial institutions using language-driven attack tools to automate intrusions and data extraction. The findings, released by CrowdStrike, point to an active operation from late September to early October 2026 that ended with exfiltration of information. The research detected digital artifacts (Claude Code session stories, Claude memory files and ARTEX configurations) exposed in open directories hosted in a Hong Kong-based IP address, which allowed for the reconstruction of parts of the infrastructure and methodology used.

In technical terms, the campaign showed the use of ARTEX, a multi-agent "agenic" penetration test system developed by Autumn-27 and originally designed for authorized safety assessment. According to CrowdStrike, the involved instance used as its core a DeepSeek v4.1-flash tagged model and accessories such as GLM-5.3 (Z.ai) and Gook 4.6 (SpaceXAI). There are indications that the actor accessed DeepSeek through an API reseller (possible domain cited as "xcai [.] pro"). The observed architecture had at least two servers: one in Hong Kong (IP 38.244.50 [.] 120) that functioned as the backbone of the attack and hosted the ARTEX instance responsible for operations against South Korean targets.

Confirmed facts: CrowdStrike has published that it found open directories with Claude sessions and ARTEX configuration files in the identified IP; the campaign focused its efforts on South Korean financial organizations and existed data exfiltration; ARTEX was part of the platform used and Autumn-27 has decided to turn ARTEX into closed after detecting its abuse. In addition, similar automation tools with LLMs have been observed in other criminal operations documented by external researchers, such as the massive account-taking platform described by ZenoX.

Estimates and elements to be confirmed: the complete attribution is not established: although the textual and language evidence suggests a profit-motivated Chinese-speaking operator, CrowdStrike does not attribute the operation to a known group. The exact relationship between the aforementioned API reseller and the model supply chain is not confirmed at 100% and some sessions contain personal data that might belong to the operator, but this cannot yet be verified conclusively.

The mechanics of the attack combines several components: first, LLM agents coordinate recognition and discovery of attack surfaces (where there are authentication points, vulnerable endpoints or reusable credentials). Then agents generate and adapt payloads or automation scripts to exploit identified fragments, and finally orchestrate data exfiltration - all with a high degree of autonomy. In the parallel operation that ZenoX investigated (platform called SCARLET LOOP), the complete automated cycle was observed: discovery of targets, obtaining credentials from info-stealers leaks or logs, automated execution of early session with instrumented browsers and reporting of valid credentials to private channels (e.g. Telegram). That report documented hundreds of billions of attempts and thousands of valid accounts, illustrating the scale that allows automation with LLMs.

Who does this affect? Especially financial organizations, platforms with high monetary value (reward programs, gift cards, corporate wallets) and users whose credentials are filtered or reused. The combination of smart bots and credentials bases amplifies the effectiveness of attacks such as credential stuffing and accountability, and facilitates data sales in clandestine markets. In addition, the exposure of sessions and configurations on open servers reveals additional risks: operational information leak, LLMs access routes and attack climbing tracks.

Real consequences: increased accountability, theft of funds or benefits, loss of personal and commercial data, and escalation of automated attacks that require scale responses by security teams. In the medium term, the public accessibility of agenic pentesting frameworks and the existence of APis LLM resellers can significantly reduce the technical barrier for less sophisticated actors.

Specific measures to be taken by security officials: first, make an active hunt looking for indicators linked to this campaign: unusual connections to IP 38.244.50 [.] 120 and to LLMs reseller services, exposed agent configuration files, threads or Claude sessions in public repositories and peaks of automated access attempts. Apply egress filtering to block suspicious domains and endpoints and restrict access to APIs models by means of whitelisting and strong authentication. In the application layer, deploy defenses against credental stuffing: require robust MFA (ideally FIDO2 / passwords), implement rate limiting and detection of speed / form, validate browser prints and human behavior, and use reputation scores for login. For development and testing environment, audit and restrict internal penalizing tools: ensure that ARTEX or similar instances only run in controlled environments and that their configurations are never exposed to public directories.

Additional operational recommendations: Rotate API keys that may have been compromised, review exfiltration logs and abnormal activity (sensitive data reading peaks), and coordinate with LLM providers to block irregular uses. Sharing indicators with response communities and local authorities helps to curb the redistribution of credentials and the sale of data. For end-users, activate MFA, do not reuse passwords and monitor notifications of unusual access; in case of suspicion, change credentials and report unauthorized access.

It is important to distinguish legitimate innovation in safety tests from criminal abuse: Autumn-27 has announced that it will turn ARTEX into closed in the face of reported misuse, and that shows a greater dilemma in the agentic tool ecosystem. Defenders should speed up the adoption of technical controls (APIs limitation, egress monitoring, browser automation detection) and organizational (IA tool use and transparency policies in suppliers) to mitigate a wave of attacks enhanced by LLMs.

To follow the investigation and obtain additional context on the technical reports, you can see the coverage of the firm that released the case and specialized press: CrowdStrike - Blog and analysis and The Hacker News they have covered similar operations. As there are open questions about the attribution and total extent of the damage, the organizations concerned must assume that the threat is persistent and take immediate and verifiable defensive action.