In a campaign spanning late September to early October 2026, hackers utilized ARTEX—a framework powered by AI, targeting South Korean financial institutions. Public reports indicated that seven entities were impacted, affecting thousands of customers. The Hunt.io investigation suggested that the reported impact was approximately 66,000 to 67,000 individuals and around 2,200 corporations.
Investigators discovered AI sessions seeking where stolen Korean data could be sold, including requests for assistance in locating Telegram sales groups.
A recovered credentials file referenced the ARTEX server, while shell scripts supported reverse SSH tunnels, service relays, and memory synchronization. The summary reveals 79 Exit IP addresses linked to ten geo-located countries, with the United States leading the list (Source: hunt.io). Hunt.io's findings detail custom routing scripts that facilitated model discovery and included reasoning settings in outgoing requests.
Researchers unearthed 19 reusable agent skills, including reconnaissance, source review, authentication testing, payment analysis, and Android application inspection.
Additional files included proxy management scripts, reconnaissance utilities, and a staged Java Naming and Directory Interface (LDAP) exploitation setup. Indicators of Compromise Type Indicator Context IP 38.244.50[. ]120 ARTEX console and jump host (Los Angeles, AS174 Cogent); ports 443, 8090, 8000, 5918, 18888 IP 23.248.226[.
]250
