Artificial Intelligence · Cybersecurity
CrowdStrike links ARTEX to South Korean data theft
CrowdStrike Intelligence said a campaign against South Korean financial organisations used the ARTEX pentesting tool and LLMs, while ZenoX separately described an AI-assisted credential-stuffing platform called SCARLET LOOP.
- CrowdStrike Intelligence said a campaign against South Korean financial organisations ran from late September to early October 2026 and ended in data exfiltration.
- CrowdStrike said the operator used ARTEX, an open-source penetration testing tool, together with large language models.
- The company said it found open directories on a Hong Kong-based IP address that exposed Claude Code session histories, Claude memory files and ARTEX configuration files.
- Autumn-27 said ARTEX had been intended for learning, research and authorised testing, and said it would stop updating the project and make it closed source after what it called abuse.
CrowdStrike Intelligence said it had identified a campaign against South Korean financial organisations that ran from late September to early October 2026 and resulted in data being taken out. It said the operator used ARTEX together with large language models.
The company said it uncovered the activity after finding open directories on a Hong Kong-based IP address. Those directories exposed Claude Code session histories, Claude memory files and ARTEX configuration files, and the analysis pointed to a two-server arrangement.
CrowdStrike said the campaign had not been tied to a known threat group. It said the evidence suggested a Chinese-speaking operator seeking money, and identified 38.244.50[.]120 as the server suspected of hosting the ARTEX instance.
Autumn-27 said ARTEX had been built for learning, research and authorised security testing, and said it would no longer be updated or maintained after what it described as misuse. Separately, ZenoX said SCARLET LOOP used AI models for credential stuffing and account takeover, and reported 12,277,358 credentials tested, with 11,832 valid across 3,968 domains.
Named in this story
Companies
- Autumn-27
- the developer that said it would close-source ARTEX
- Z.ai
- the company whose GLM-5.3 model supplemented the setup
- ZenoX
- the Brazilian cybersecurity company that disclosed SCARLET LOOP
Organisations
- CrowdStrike Intelligence
- disclosed the campaign and the forensic findings
Products and systems
- ARTEX
- the pentesting tool used in the South Korean campaign
- Claude Code
- its session histories were found in the exposed directories
- DeepSeek v4.1-flash
- the main LLM backend used by the ARTEX instance
- GLM-5.3
- a supplementary model used in the ARTEX setup
- Grok 4.6
- another supplementary model used in the ARTEX setup
- SCARLET LOOP
- the credential-stuffing and account-takeover platform
- GPT-5.6
- used for search-query generation in SCARLET LOOP
- GPT-5.5
- used for target classification and rating in SCARLET LOOP
- DeepSeek-V4-Pro
- used by the browser agent in SCARLET LOOP
- DeepSeek-V4-Flash
- used by the browser agent in SCARLET LOOP
- Claude Opus 4.6
- configured as one of the models in SCARLET LOOP
- Google Gemini 2.5 Flash
- configured as one of the models in SCARLET LOOP
Places
- Hong Kong
- the location tied to the IP address hosting exposed directories
- South Korea
- the country where the financial organisations were targeted
- China
- the country where ARTEX was described as having been developed
- Brazil
- the market country targeted by SCARLET LOOP and home to ZenoX
How the source tells it
Mostly straight reporting, with vendor-flavoured novelty framing around autonomous AI tooling and attack scale.
- novelty by describing the tooling as agentic, autonomous and multi-model driven
- vendor boosterism by relaying the companies' own capability claims and tool inventories
- urgency by ending with a broad claim that attackers are increasingly adopting AI