Ethical Hacking News
A recent data breach affecting seven South Korean financial institutions has shed light on the exploitation of ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. The breach, which occurred between late September and early October 2026, exposed the personal, employment, income, and loan data of approximately 66,000 to 67,000 individuals and around 2,200 corporations. The incident highlights the risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling, and emphasizes the need for organizations to take proactive measures to secure their systems and protect sensitive data.
Seven South Korean financial institutions were affected by a data breach. The breach exposed personal and corporate data of 66,000 to 67,000 individuals and 2,200 corporations. A Chinese-speaking individual was responsible for the breach, using ARTEX tools for unauthorized access. The ARTEX framework was exploited to gain access to sensitive systems, highlighting risks associated with exposed administrative services and tools. The breach highlights the need for organizations to secure their systems and protect sensitive data.
The recent data breach affecting seven South Korean financial institutions has shed light on the exploitation of ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. The breach, which occurred between late September and early October 2026, exposed the personal, employment, income, and loan data of approximately 66,000 to 67,000 individuals and around 2,200 corporations.
Hunt.io, a cybersecurity company, traced the ARTEX servers and AI-powered hacking tools used in the breach. The company's investigation found that a single Chinese-speaking individual, motivated by financial gain, was responsible for the breach. The individual used a combination of ARTEX tools, including the DeepSeek v4.1 Flash, GLM 5.3, and Grok 4.6, to gain access to the financial institutions' systems.
The ARTEX framework is designed to facilitate autonomous penetration testing, but it has been exploited by hackers to gain unauthorized access to sensitive systems. The breach highlights the risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.
The investigation also revealed that the hacker used a reseller domain, xcai[.]pro, to access the ARTEX console and other services. The domain was used to host the ARTEX console, which was accessible through ports 443 and 8090. The hacker also used a proxy script to enumerate a rotating proxy service, which was used to share a single port for web and LDAP traffic.
In addition to the ARTEX framework, the hacker used other tools, including a script that queried FOFA, a Chinese asset search engine like Shodan, through a third-party API. The script also enumerated a rotating proxy service and used a small staged setup for JNDI and LDAP exploitation.
The breach has significant implications for the security of financial institutions and other organizations that rely on ARTEX tools. The incident highlights the need for organizations to remove public access to administrative services, put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials, and tokens.
The investigation also shed light on the tactics, techniques, and procedures (TTPs) used by the hacker. The TTPs included the use of a small local proxy to address a compatibility issue with the official /v1/models endpoint. The proxy intercepted specific requests and returned a locally defined model list, allowing the hacker to discover available models.
The breach also highlights the importance of monitoring for unexpected LDAP and JNDI activity, DNS callbacks, and remote script downloads. Organizations must also store secrets in a managed vault with least-privilege permissions and restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones.
In conclusion, the recent data breach affecting seven South Korean financial institutions highlights the risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling. The breach emphasizes the need for organizations to take proactive measures to secure their systems and protect sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/ARTEX-AI-Hacking-Tools-and-Exposed-Servers-Behind-South-Korean-Bank-Breaches-ehn.shtml
https://securityaffairs.com/202607/ai/inside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches.html
Published: Sat Nov 7 14:15:09 2026 by llama3.2 3B Q4_K_M
