The attacker left the notes on the server. CrowdStrike Intelligence found open directories on infrastructure tied to a run of data breaches at South Korean financial organizations, and inside them were AI coding-assistant session histories, memory files and configuration for an agentic hacking tool, a working record of how the intrusions were planned and run.
That record is why CrowdStrike's report, written by Ashley Campion, matters beyond South Korea. It is one of the clearest views yet of a criminal using off-the-shelf AI agents to run real intrusions against real banks.
Several banks hit in two weeks
Starting in late September 2026, several South Korean financial organizations suffered data breaches that resulted in exfiltrated data. Citing industry reports, CrowdStrike says that at one bank the attacker reportedly breached a loan progress inquiry service used by financial brokers, while at another an employee mobile work-support system was compromised. How many organizations were affected is still unconfirmed, though activity at several of them reportedly involved overlapping IP addresses. The campaign ran from late September to early October.
An agentic pentest tool, steered by chatbots
The central tool is ARTEX, a recently released open-source agentic penetration-testing framework developed in China. One server, 38[.]244[.]50[.]120, hosted an ARTEX instance and an exposed instruction file containing a Chinese-language prompt telling the model how to conduct penetration testing. A second, Hong Kong-based server held the session histories and ARTEX configuration, and CrowdStrike says the targets named there overlap with the organizations in the breach reporting.
The ARTEX instance used DeepSeek as its main model backend, likely reached through a reseller API proxy, and the operator also ran sessions with Zhipu AI's GLM and Grok models. The logs go beyond hacking: the operator asked an AI assistant where stolen Korean breach data is usually sold and for help finding Korean Telegram groups that trade it.
Who is behind it, and how sure is that
CrowdStrike has not tied the activity to a named adversary. It assesses with moderate confidence that the operator is a Chinese speaker and financially motivated, based on the Chinese-developed tool and the Chinese-language prompts. One session asked an assistant to write a security-researcher resume showcasing the results of the campaign and included personal details, but CrowdStrike cautions that it cannot definitively link those details to the operator, so we are not repeating them.
The broader point fits a pattern this site has tracked, from malware that lets AI models choose its next move to Google's finding that AI is changing which bugs get exploited. CrowdStrike's assessment is that AI tooling let one financially motivated actor run multiple intrusions in a short time span, and that adversaries will likely keep folding these tools into their operations.
Block the infrastructure and watch for agent-speed probing
Financial institutions, particularly in South Korea, should block and hunt for the indicators below in perimeter and proxy logs. More broadly, automated agents tend to probe many internet-facing services quickly, so rate-based alerting on web applications and partner portals, such as broker-facing inquiry services, is worth reviewing.
Indicators published by CrowdStrike:
- Actor-controlled host: 38[.]244[.]50[.]120
- Proxy addresses: 101[.]53[.]80[.]20, 205[.]214[.]59[.]31, 124[.]155[.]252[.]63, 154[.]201[.]79[.]246, 23[.]248[.]249[.]90
- Proxy addresses: 23[.]158[.]220[.]98, 103[.]248[.]148[.]84, 203[.]160[.]133[.]172, 209[.]209[.]85[.]38
The tooling was new. The sloppiness was not: an operator with an AI co-pilot still left the session logs where a defender could read them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.