Maker pulls ARTEX AI hacking tool after South Korea bank breaches
The Chinese developer of ARTEX, an AI tool linked to a wave of South Korean bank hacks, said Thursday it will no longer release the tool publicly. CrowdStrike says a Chinese-speaking hacker used ARTEX with Anthropic's Claude to steal data. At least nine Korean banks have been reported as targets since late September.
An AI tool built to help companies find holes in their networks has become the center of South Korea's biggest bank hacking scare in years. Now its maker is pulling it from public view.
The developer of ARTEX, who goes by Autumn-27 on GitHub, said Thursday the project will be converted to closed source. "No further versions will be released to the public, nor will maintenance support be provided," the developer wrote, according to The Straits Times. The developer said the tool was meant for security testing and opposed any illegal use.
ARTEX is not an AI model itself. It connects to models such as Claude, ChatGPT and DeepSeek and uses them like a team, SBS News reported. Because it was free and open to anyone, it was easy to misuse.
CrowdStrike, a U.S. security firm, traced the attacks to a server running ARTEX. It said the hacker used DeepSeek as the main engine, plus Anthropic's Claude Code, and also asked Claude where to sell stolen Korean data on Telegram, Infosecurity Magazine reported. CrowdStrike said with moderate confidence the attacker speaks Chinese and was after money.
One Claude session held a resume with personal details, including a location in Maoming, China, and an age of 26. CrowdStrike said those details likely belong to the attacker but cannot yet be tied to them for certain.
The hackers went after systems used by staff and brokers, not customer banking apps. Shinhan Bank and Yegaram Savings Bank reported breaches affecting about 25,000 and 40,000 people, Infosecurity Magazine reported. South Korea's Financial Services Commission warned customers on October 6 to watch for phishing and loan scams.
Police opened a probe this week. China's foreign ministry said it was not familiar with the case and opposes hacking.
What we know: ARTEX was used in the attacks, and its maker has pulled public releases.
What we don't: Who the attacker is and how many firms were breached.
Where outlets agree Infosecurity Magazine and The Straits Times both report CrowdStrike tied the South Korean bank attacks to the ARTEX tool and Anthropic's Claude Code.
Where they differ Infosecurity Magazine reports researchers tied all the bank attacks to the same IP address, while SBS News reports the attacks were routed through about 20 IP addresses in more than 10 countries.