ARTEX Intel中文

Timeline

First wave of intrusions at Korean financial institutions (7 institutions)

Event date2026-09-27 to 2026-10-04
Disclosed2026-10-01
TypeData theft
ConfidenceConfirmed
ARTEX statusARTEX named by sources
Countries and regionsSouth Korea
SectorsBanking, Savings banks, Finance

The earliest known attack date is Sep 27. The first report to the authorities came on Sep 30 (Shinhan). Disclosures followed from Oct 1 to Oct 4. The attack surface was mainly external-facing edge applications, and the methods included SQL injection and authentication bypass. A Financial Security Institute (FSI) official said it was not a fully autonomous attack without human involvement.

Confirmed victims

  • Shinhan Bank
  • KB Kookmin Bank
  • Hana Bank
  • BNK Busan Bank
  • Yegaram Savings Bank
  • Hyundai Capital
  • Welcome Savings Bank

Targets

  • Woori Bank (says it blocked the attack)
  • NH NongHyup Bank (says it blocked the attack)

Attribution

ARTEX basis
None of the three Financial Services Commission (FSC) press releases of Oct 4, Oct 14 and Nov 5 mentions ARTEX. The ARTEX claim comes from an anonymous Financial Security Institute (FSI) official (Herald Business, Oct 3, scope limited to Shinhan) and the CrowdStrike report of Oct 7. CrowdStrike did not name the victim institutions.
Actor
CrowdStrike: financially motivated, likely Chinese-speaking (medium confidence), not attributed to a known group. Recorded Future tracks it as TAG-217.
Same attacker?
Yonhap reported on Oct 4, citing the authorities, that the same attacker IP was seen at the 7 institutions. The Financial Services Commission (FSC) changed this on Oct 14 to "under close review", and there has been no official confirmation since.

Figures and definitions

Victim countAbout 66,000 people, about 2,200 corporate records (Genians, as of Oct 4)
Victim countAbout 67,000 people (Zscaler, Oct 14)
Victim countAt least 68,000 people (Recorded Future)
Victim countAbout 68,000 (Weekly Kyunghyang, Oct 12, 7 institutions)
Shinhan25,729 (Herald Business, National Assembly audit materials); 25,727 (CEO Score and others)
KB119 people (Oct 2); corrected to 2,210 people (Oct 26)
YegaramAbout 40,000 (Oct 2); about 50,000 (Oct 13)
Attack IPsFSS: 19 IPs, 12 countries (Financial News, Oct 6); 28 IPs, 12 countries (industry sources); 33, or 28 after deduplication (Genians); more than 20 IPs across more than 10 countries (WSJ, as relayed); CrowdStrike lists 9 proxy IPs
Reason for the block (Woori)Five accounts: intrusion prevention system; no such vulnerability; multi-factor authentication; luck; Xint inspection (sources include the vendor)

Related IoCs

TypeValueRoleCheck
CertificateC7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842TLS certificate on 38.244.50[.]120, issuer organization ARTEXSource report only
Docker imageartex-local:perf2-20261003Custom image tagSource report only
Domainapi[.]anthropic[.]comLegitimate LLM service, not attacker infrastructure. Use only as an outbound behavior lead.Shared or legitimate service
Domainapi[.]deepseek[.]comLegitimate LLM service, not attacker infrastructure. Use only as an outbound behavior lead.Shared or legitimate service
Domainapi[.]x[.]aiLegitimate LLM service, not attacker infrastructure. Use only as an outbound behavior lead.Shared or legitimate service
Domaindirect[.]xcai[.]proEndpoint in the model-routing configurationPlatform: suspicious
Domainfofoapi[.]comThird-party service, not attacker infrastructure.Shared or legitimate service
Domainopen[.]bigmodel[.]cnLegitimate LLM service, not attacker infrastructure. Use only as an outbound behavior lead.Shared or legitimate service
Domainu6ud2s[.]dnslog[.]cnDNS callback hostname in a staged exploitation artifactPlatform: malicious
Domainxcai[.]prolikely LLM API proxy/resellerPlatform: suspicious
Fingerprint127.0.0.1:5435local PostgreSQL mappingSource report only
FingerprintARTEX - 自主渗透测试控制台(자율 침투테스트 콘솔)HTML title on an attack-infrastructure web server (Section 4.2)Source report only
FingerprintARTEX — 自主渗透测试控制台ARTEX default titleSource report only
FingerprintLLM 驱动的自主渗透测试系统控制台(LLM 기반 자율 침투테스트 시스템 콘솔)Meta descriptionSource report only
Fingerprintgrok2apiGrok bridge serviceSource report only
IP101[.]53[.]80[.]20Proxy IP addressPlatform: no verdict
IP103[.]248[.]148[.]84Proxy IP addressPlatform: no verdict
IP124[.]155[.]252[.]63Proxy IP addressPlatform: no verdict
IP154[.]201[.]79[.]246Proxy IP addressPlatform: no verdict
IP161[.]8[.]161[.]140Upstream SOCKS proxyPlatform: no verdict
IP203[.]160[.]133[.]172Proxy IP addressPlatform: malicious
IP205[.]214[.]59[.]31Proxy IP addressPlatform: no verdict
IP209[.]209[.]85[.]38Proxy IP addressPlatform: no verdict
IP23[.]158[.]220[.]98Proxy IP addressPlatform: no verdict
IP23[.]248[.]226[.]250Work serverPlatform: malicious
IP23[.]248[.]226[.]251Work serverPlatform: malicious
IP23[.]248[.]226[.]252Work serverPlatform: malicious
IP23[.]248[.]226[.]253Work serverPlatform: malicious
IP23[.]248[.]226[.]254Work serverPlatform: malicious
IP23[.]248[.]249[.]90Proxy IP addressPlatform: malicious
IP38[.]244[.]50[.]120Threat actor-controlled IP addressPlatform: malicious
File pathsync-memory.shcustom synchronization scriptSource report only
File pathtools/project_context_hook.pycontext hook scriptSource report only
File pathtools/sync-all.shcustom synchronization scriptSource report only
File pathtools/sync-cc-users.shcustom synchronization scriptSource report only
File pathxcai-shim.pyprotocol shimSource report only
URLhxxp://38[.]244[.]50[.]120:18899/[.]claude/CLAUDE[.]mdClaude Code markdown fileSource report only
URLhxxps://xcai[.]pro/v1ARTEX model gatewaySource report only

View all 38

Related events

Sources (32)