CrowdStrike Claims Korean Bank Attacks Used Open Source Penetration Testing Tool ARTEX and Called DeepSeek
CrowdStrike released a report on Wednesday stating that attacks on South Korean financial institutions from late September to early October utilized the Chinese open-source penetration testing tool ARTEX, with the main model backend being DeepSeek v4.1-flash. The company did not attribute the incident to any named organization but assessed with moderate confidence that the actors were likely Chinese speakers with profit motives, based on the use of ARTEX and Chinese prompts in the sessions.
The report is based on an analysis of AI programming tool sessions and related infrastructure. ARTEX is described as a newly released Chinese open-source tool that is not a large model itself but connects to external models like ChatGPT, Claude, and DeepSeek. The official page states it is intended for personal learning, code research, and local validation, and should not be used for real testing on online systems. CrowdStrike noted that the attackers primarily called the models through Claude Code sessions, with DeepSeek v4.1-flash as the main backend, along with Zhiyu GLM-5.3 and Grok 4.6. The calls to DeepSeek likely went through a resale interface xcai.pro, rather than the actors' own direct accounts.
An unverified personal document appeared in the sessions. The actors had Claude draft a resume for a security researcher, stating a 26-year-old background from South China University of Technology. South Korean media reported inconsistencies in the information, and the identity remains unconfirmed. CrowdStrike also identified two servers: one in Hong Kong as the main infrastructure and another hosting the ARTEX instance. Document analysis revealed inquiries about marketplaces for stolen data from Korea and related Telegram groups, used to support profit motives.
The banks have disclosed numbers. Shinhan Bank reported about 25,000 customers affected, KB Kookmin Bank reported 119 customers, and Hana Bank reported 89 customers' information exposed. Reuters stated that at least nine South Korean banks have been disclosed or reported as targets since late September. The systems mentioned include a loan inquiry service for financial intermediaries used by one bank and a mobile office support system used by another bank. The total amount of stolen data and the full scope of the intrusion have not been confirmed.
The South Korean police have opened a case this week and stated that they have identified 28 related IP addresses, most of which appear to be masking real traces. President Lee Jae Myung has called for a strong response. The National Assembly's Policy Committee has approved subpoenas for the presidents of KB Kookmin, Shinhan, Hana, Woori, and NH Nonghyup banks during an audit on October 19. Financial authorities are considering relaxing network isolation to strengthen AI defenses.
This is event-driven security procurement, not model stock price announcements. The buyers are South Korean banks needing to supplement customer notifications, audits, and protections, while the sellers are security companies providing incident response and endpoint detection. Benefiting are vendors like CrowdStrike that turn session logs into attribution. Under pressure are the named banks, DeepSeek as the main backend, and the resale interfaces that separate calls and accounts. The flow of money is towards compliance fines, customer compensation, and security contracts, not sell-off orders in the public market.
Source: Public Information
ABAB AI Insight
CrowdStrike's public path is to sell endpoint logs for attribution. After the 2016 Democratic National Committee incident, it used intrusion indicators to achieve public company status. The new materials in this report are not malware family names but rather Claude Code sessions, ARTEX configurations, and memory files. The actors had the model write a resume, leaving clues of identity in the tool vendor's records by including age 26 and South China University of Technology in the session. The moderate confidence is explicitly stated by the company, and the resume information has also been reported as inconsistent by South Korean media.
Capital is in the interface, not in the model brand. ARTEX connects planning to external models, with DeepSeek v4.1-flash as the main backend, supplemented by GLM-5.3 and Grok 4.6, and the calls pointed to the resale interface xcai.pro by CrowdStrike. Resale separates the billing and real accounts, with model companies receiving aggregated traffic. South Korean banks are paying with customer data: Shinhan about 25,000, Kookmin 119, Hana 89. The National Assembly is set to subpoena five bank presidents on October 19, shifting the cost from technical incidents to management accountability.
The analogy is that after 2016, pirated software and remote control tools were sold separately, with investigations targeting distributors rather than authors. The industry position is one of abuse during an expansion period: open-source penetration frameworks combined with interchangeable models mean Claude's safeguards only cover requests directed at the Claude model. DeepSeek, Zhiyu, and Grok each only see their own interfaces and do not see the entire task.
Structurally, this represents a transfer of pricing power. In the past, attack attribution relied on malware and IP, with pricing power in the security company's feature library. Session logs distribute pricing power to model suppliers and resale sites. The mechanism separates the agent shell and model, with billing not under the actor's name, halting tracking at the resale interface. Whoever retains the session and resume draft holds the next identity clue. Whoever only sells computing power is first written as a backend, rather than as an employer.
ABAB News · Cognitive Law
The place where tools are archived is where identity is exposed.
Models can be interchangeable, and billing will separate from individuals.
Once the resale interface is inserted, investigations first stop at the billing layer.