What happened
The threat actor deployed ARTEX with a DeepSeek backend and used Claude Code and other LLM sessions to conduct extensive targeting, discover vulnerabilities, compromise specific services, and support handling of stolen data.
2026-10-07
HighPrimaryThreat Actor Used ARTEX and LLMs in South Korean Financial Intrusions That Exfiltrated Data
CrowdStrike linked ARTEX, Claude Code sessions, and multiple LLMs to a campaign against South Korean financial organizations that resulted in data exfiltration.
ARTEXTool execution / MCPAttacker-operated agentic penetration testing and LLM workflows used to discover vulnerabilities and compromise financial-sector servicesInternet-facing and employee-support services at South Korean financial organizations
Why it matters
Compromise of services at South Korean financial organizations and exfiltration of data. Public reporting tied the campaign to affected bank systems, but the total victim count and the mapping between ARTEX activity and every reported breach remained unconfirmed.
Missing authorization check
An independently enforced authorization decision in the agent operator's environment binding each reconnaissance, exploitation, credential-use, data-access, and export action to the exact target and approved scope.
Would PP block it?
If the attacker-controlled or a legitimate penetration-testing environment had integrated an external Tool-Call Gate, exploit-capable actions could require target-bound, time-limited authority before dispatch. That hypothetical operator-side control does not mean victims could stop the campaign with Permission Protocol alone.
Incident analysis
Timeline and technical read
Timeline
2026-09-25
CrowdStrike places the beginning of the observed campaign in late September 2026.
2026-10-04
Industry reporting describes data breaches at several South Korean financial organizations and overlapping attacker infrastructure.
2026-10-07
CrowdStrike publishes its analysis linking ARTEX, Claude Code session histories, and multiple LLMs to the campaign.
2026-10-08
Independent reporting describes the campaign and repeats CrowdStrike's qualified attribution and confirmed data-exfiltration finding.
Technical breakdown
- An attacker-controlled server hosted an ARTEX instance and an exposed Claude Code markdown file containing a Chinese-language penetration-testing prompt.
- A second attacker-controlled server exposed Claude Code session histories, ARTEX configuration files, and Claude memory files covering the South Korean targeting.
- The ARTEX deployment used DeepSeek v4.1-flash as its primary LLM backend, with GLM-5.3 and Grok 4.6 used in additional Claude Code sessions.
- CrowdStrike says ARTEX was primarily used to discover vulnerabilities and compromise specific services at victim organizations.
- The actor also asked Claude about markets for Korean breach data, while CrowdStrike left the actor unnamed and assessed likely Chinese-language and financial motivation with moderate confidence.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- The agent operator's outbound reconnaissance, exploitation, credential-use, and data-export tool boundaries
- Still needs
- Permission Protocol does not patch exposed services, detect attacker infrastructure, secure victim networks, or stop an external operator that has not integrated the authority gate. Network segmentation, patching, credential security, endpoint controls, and incident response remain necessary.
- Receipt required for
- Executing an exploit-capable action or exporting data against the named target, operation, scope, and expiry
Permission Protocol deployed by the victim organizations would not prevent an external attacker from probing or exploiting public services, and it is not a perimeter defense.
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.