ARTEX Hackers Expose Their Own Servers, Revealing AI Tools Behind South Korean Bank Breaches

A hacker’s own mistake has given researchers a rare look at how AI tools were used to break into South Korean financial firms. The operator left several servers open to the public, and the exposed files showed which AI models, scripts and proxies powered the campaign.

Between late September and early October 2026, seven South Korean financial institutions had data stolen through internet-facing systems. Roughly 66,000 to 67,000 people and about 2,200 companies were affected.

Names, jobs, income details and loan information were exposed. CrowdStrike first tied the activity to ARTEX, an open-source, China-developed AI penetration testing framework.

CrowdStrike judged, with moderate confidence, that a single Chinese-speaking, financially motivated lone operator used ARTEX instead of a known hacking group.

The public reports named one key server at 38.244.50[.]120 and a reseller domain, xcai[.]pro, used to reach AI models. Genians later confirmed the same findings, and the ARTEX GitHub page and Docker image were taken down on October 11, though copies remain online.

Researchers at Hunt.io noted that the public indicators were only part of the picture. While pivoting off the known server, they found a new open directory at 23.248.226[.]250, a Hong Kong jump server that held far more of the operator’s working files.

ARTEX Hackers Expose Their Own Servers, Revealing AI Tools

The Hong Kong server held a state file showing the operator ran Claude Code, version 2.1.221, and had started it 510 times since August 4, 2026. The software was not talking to Anthropic, though.

A router called Claude Code Router, plus small Python helper scripts, sent every request through the xcai[.]pro reseller to DeepSeek. This resembles other cases where Claude Code and DeepSeek were joined in one workflow.

One helper script even carried a note in Chinese describing the route in the operator’s own words. Other files showed a Zhipu AI key for GLM models and a tunnel named grok2api, which fits CrowdStrike’s finding that DeepSeek, GLM and Grok were all in use.

The state file also listed 19 custom “skills,” which are reusable instruction sets for the AI agent, used 147 times in total. They covered reconnaissance, code review, web testing, firewall bypass checks, Android app analysis and cloud phone control.

One skill tested payment logic, and a nearby file held three test accounts for a cash-in deposit service. That setup suggests the operator was checking for insecure direct object reference flaws. These flaws let a user view or change another person’s data by altering an ID.

A credentials file named .secrets was also found, along with a backup copy. A Chinese comment inside it said it was the “sole source of credentials” and warned against pasting passwords into a session.

Three scripts used that same root login to keep a reverse SSH tunnel alive and to copy the AI’s memory files to the jump host.

Wider Tools, Hunting Pivots and Defense

The exposed folders held more than bank-related tools. Hunt.io found a proxy service at 154.201.79[.]246:443 that gave 79 unique exit IP addresses from the first 100 identities tested.

It also found a staged JNDI and LDAP setup for remote code execution, with a DNS callback to confirm success.

Other files included cryptocurrency exchange scripts, Linux privilege escalation exploits and iOS and Android tooling. Hunt.io says the link between these items and the bank breaches is unconfirmed.

Hunt.io then built three ways to find more ARTEX servers. A certificate search returned 19 IP addresses, a malware-tag search returned 1,303, and a search on the console’s page title returned about 1,300.

A separate search for open directories returned 280 results. The tags covered 30 countries, led by the United States, then China and Hong Kong.

This shows the framework is spreading well beyond one case, which matches reports of ARTEX automating enterprise attacks elsewhere.

Defenders should close public access to admin services and place them behind a VPN or allowlist. They should also reset SSH passwords and rotate API keys, proxy logins and tokens that may have sat in exposed files.

Teams should watch for odd LDAP or JNDI traffic, strange DNS callbacks, remote script downloads and unexpected outbound connections.

They should also lock down access to AI model gateways. Later, South Korean police arrested a suspected hacker over a separate case that also involved ARTEX, though the shared tool does not prove the same people were involved.

Indicators of compromise (IoCs):-

Indicator	Type	Context
38.244.50[.]120	IPv4 address	ARTEX console host and SSH tunnel destination in recovered configuration
23.248.226[.]250	IPv4 address	Hong Kong jump host with exposed directories and tooling
154.201.79[.]246	IPv4 address	Proxy service used by proxy enumeration scripts
xcai[.]pro	Domain	AI service reseller domain tied to the campaign
direct[.]xcai[.]pro	Domain	Endpoint in the model-routing configuration
fofoapi[.]com	Domain	Third-party API used by the recovered FOFA client
u6ud2s[.]dnslog[.]cn	Domain	DNS callback host in the staged exploit
38.244.50.120:8000	IP and port	Exposed directory with scripts and files
23.248.226.250:18099	IP and port	Exposed directory with 42 files across two subdirectories
23.248.226.250:8001	IP and port	Directory hosting the JNDI/LDAP exploitation setup
C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842	SHA-256 certificate fingerprint	TLS certificate on 38.244.50[.]120 with issuer organization ARTEX
ARTEX – 自主渗透测试控制台	HTTP title	ARTEX console title used for Hunt.io searches

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.