Exposed ARTEX servers reveal AI tools used in South Korean financial data thefts
BREACHCrowdStrikeredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Researchers found that an operator behind the ARTEX open-source AI penetration testing framework left servers publicly accessible, exposing the models, scripts and proxies used in attacks on seven South Korean financial institutions between late September and early October 2026. Stolen data included names, jobs, income details and loan information for roughly 66,000 to 67,000 people and about 2,200 companies. CrowdStrike assessed with moderate confidence that a single Chinese-speaking, financially motivated operator was responsible.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Close public access to admin services and place them behind a VPN or allowlist.
- Reset SSH passwords and rotate API keys, proxy logins and tokens that may have been exposed.
- Watch for unusual LDAP or JNDI traffic, strange DNS callbacks, remote script downloads and unexpected outbound connections.
- Lock down access to AI model gateways.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies
Products