CrowdStrike Finds ARTEX Files on Attacker Server, Cites Likely South Korea Financial Attacks
CrowdStrike says it found ARTEX configuration files and Claude Code work records on an attacker-controlled server, assessing the tool was likely used against South Korean financial institutions.
CrowdStrike published analysis on October 7 stating that it obtained ARTEX configuration files and Claude Code work records from a folder exposed on a server controlled by the attacker. The company assessed that the attacker used a Hong Kong server as a main base and ran ARTEX on a separate server, according to byline.network.
CrowdStrike said there is a high possibility the ARTEX server was used in attacks on South Korean financial institutions.
In a separate analysis, SK Shields examined ARTEX source code version 0.3.14 and described its Planner and Worker agent structure. Everspin ran an experiment using ARTEX against a test web application, reaching its goal in 22 seconds over 6 work cycles.
Enki Whitehat assessed that ARTEX has a wider attack scope than typical web vulnerability scanning tools.
Earlier findings
On October 2, Moon Jong-hyun of Genians said via LinkedIn that HTML of web servers used in attacks on multiple South Korean targets contained the Chinese string “ARTEX — 自主渗透测试控制台”. On October 4, Financial Services Commission chairman Lee Eok-won said at an emergency financial sector inspection meeting that the possibility of AI-based attacks cannot be ruled out. On October 6, SK Shields published analysis of ARTEX source code version 0.3.14.
Quick answers
What did CrowdStrike say it found?
CrowdStrike said it obtained ARTEX configuration files and Claude Code work records from a folder exposed on a server controlled by the attacker.
Where did CrowdStrike assess the attacker's servers were located?
CrowdStrike assessed that the attacker used a Hong Kong server as a main base and ran ARTEX on a separate server.
How did Everspin test ARTEX?
Everspin ran an experiment using ARTEX against a test web application, reaching its goal in 22 seconds over 6 work cycles.