Breach · 1 source · latest 4h

Exposed ARTEX servers reveal AI tools used in South Korean financial data thefts

BREACHCrowdStrikeredteam/daily · 1 source

Severity: High
Sources: 1

What happened

CrowdStrike attributed the activity with moderate confidence to a lone, Chinese-speaking, financially motivated operator using the China-developed open-source ARTEX framework, which the GitHub page and Docker image were removed from on October 11, though copies remain online. Hunt.io pivoted to an exposed Hong Kong jump host holding the operator's Claude Code 2.1.221 state file, a Claude Code Router and scripts routing requests via a reseller to DeepSeek, plus GLM and Grok keys, 19 AI skills and a .secrets credentials file. Defenders should restrict admin services behind a VPN or allowlist, rotate SSH passwords, API keys, proxy logins and tokens, and hunt for JNDI/LDAP traffic, unusual DNS callbacks and remote script downloads. No CVE identifiers are given in the articles.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Close public access to admin services and place them behind a VPN or allowlist.
Reset SSH passwords and rotate API keys, proxy logins and tokens that may have been exposed.
Watch for unusual LDAP or JNDI traffic, strange DNS callbacks, remote script downloads and unexpected outbound connections.
Lock down access to AI model gateways.

Written by AI from the sources, checked against them

Read the full story at the source