Observed incident

ARTEX-linked campaign targets South Korean financial organizations

Reported

What happened

CrowdStrike linked exposed ARTEX configurations and Claude Code session histories to a campaign involving data theft from South Korean financial organizations in late September and early October.

Parties and reporting

AI tools and systems: ARTEX, Claude Code, DeepSeek v4.1-flash, GLM-5.3, Grok 4.6

Outcome

On October 14, Korean regulators ordered blocking, patches or service suspensions and on-site reviews after broader financial-sector breaches. Whether those breaches share an attacker or involved AI remains under investigation.

Operating lesson

Apply strong authorization and enumeration controls to broker and employee systems, and monitor for fraud after customer-data exposure.

Evidence and limits

October 4 dates verified AI-campaign coverage; its October 2 social-post reference is not independently verified here. Technical disclosure followed October 7. The regulator’s broader tally of 16 firms and about 100,000 customer-data items is not a confirmed ARTEX victim count. Chinese-language clues do not establish nationality or state sponsorship.

Sources