Exposed Claude Code Logs Tie an AI Pentest Agent to Data Leaks at Korean Financial Firms, CrowdStrike Says

CrowdStrike Intelligence said on October 7 that it had identified infrastructure associated with a late September to early October campaign against South Korean financial organizations. According to its report, the operator paired ARTEX, “a recently released open-source agentic penetration testing (pentesting) tool developed in China,” with large language models, and open directories on servers the actor controlled held Claude Code session histories, ARTEX configuration files and Claude memory files. On Sunday the Korea Herald reported that the Seoul security firm Logpresso had tied a Telegram account named in CrowdStrike’s report to a community created by a Chinese group that runs DDoS attacks for hire. In the Herald’s account, that link does not establish who carried out the hacks.

I read CrowdStrike’s report and the Korean and international coverage of it, checked Anthropic’s Claude Code documentation, and ran queries against GitHub’s public search. I could not find Logpresso’s own report, so its findings below come from the Korea Herald. I have not run ARTEX. I am leaving out the personal details in CrowdStrike’s report, because the firm says they cannot be definitively tied to the actor and the owner of a phone number in it has denied involvement.

What CrowdStrike Found

CrowdStrike describes a two-server setup. A Hong Kong address was the operator’s primary infrastructure, and a second address hosted the ARTEX instance that the report says was likely responsible for the Korean attacks. That second server’s open directory included a Claude Code file, .claude/CLAUDE.md, which held “a Chinese-language pentesting prompt that specified how the LLM should conduct pentesting activities.” The report names the models: “The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.” It adds that the actor likely reached DeepSeek through an LLM API reseller and used nine proxy IP addresses, which the report lists in its indicator table.

The sessions also show what the operator asked for besides the intrusions. CrowdStrike says the actor asked Claude “where threat actors typically sell Korean data breach information” and for help “finding Korean Telegram data sales groups.” The report does not name an adversary. It assesses, with moderate confidence and on the strength of ARTEX and Chinese-language prompts, that the actor is “likely a Chinese speaker and financially motivated.” It links the sessions to the Korean incidents by overlap (“Targeted organizations overlap with those identified in industry reporting”) and says the number of organizations affected “remains unconfirmed.” Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, told reporters on Thursday that the case shows a human adversary using AI agents, which “allows one human to target many customers in a very short period of time using the power of AI,” according to Reuters.

What the Claude Label Does and Does Not Show

Reuters’ lead said the suspect “used a Chinese-developed AI agent and Anthropic’s Claude Code,” and the BleepingComputer headline spoke of “Claude agents.” CrowdStrike’s text supports something narrower. It names Claude Code session histories, Claude memory files and a CLAUDE.md file, and the models it names as backends are DeepSeek, GLM and Grok. The body of the report does not mention Anthropic and does not say which model answered the prompts it describes as asked of Claude. Its wording for GLM-5.3 and Grok 4.6, used “for additional Claude Code sessions,” reads as the Claude Code program being pointed at other vendors’ models, though the report does not describe the configuration.

Anthropic’s documentation helps in reading that. It says CLAUDE.md files are “markdown files that give Claude persistent instructions,” and that Claude reads them “at the start of every session.” Its gateway page says “Any gateway that exposes a supported API format works,” refers to the ANTHROPIC_BASE_URL setting for gateway endpoints, and adds that Anthropic “doesn’t support routing Claude Code to non-Claude models through any gateway.” The page does not say such routing is impossible, only that Anthropic does not support it. So the public record shows Claude Code as the working environment and Claude named in prompts. It does not show Anthropic’s models carrying out the intrusions. Reuters said Anthropic did not respond to its request for comment, and I found no later statement.

The distinction matters for defense. The agent program, the model behind it and the attack tool are three separate choices, so a safeguard that lives in one vendor’s model can only apply to requests that vendor’s model answered. Our check of MIT Technology Review’s refusal essay covers why a model’s “no” is a vendor setting, not a control the deployer owns.

What the Firms and Regulators Have Reported

The Korea Herald, the JoongAng Daily and Kyunghyang Shinmun (whose English edition is machine-translated) give these figures. The units differ, so they cannot be added cleanly.

Adding the published figures gives about 65,000 to 68,000 people or records, depending on whether Shinhan’s 25,727 (Kyunghyang’s count) and Welcome’s corporate records are included. That is my arithmetic, and it mixes customers, loan agents, developers and corporate records. Counting institutions is just as loose. Reuters wrote on October 8 that “at least nine South Korean banks” had disclosed or been reported by local media as targets since late September. The Korea Times said the attacks affected at least five lenders, and the Korea Herald said on Sunday that the attacker reportedly targeted seven institutions in succession.

Korean reporting describes the weak points as side systems. Kyunghyang quotes Stealien chief executive Park Chan-am saying the main financial systems “were fine because there are authentication mechanisms beyond IDs and passwords, but this time, because they were peripheral systems, that kind of attack appears to have been possible.” The paper adds that the attack is presumed to have been AI-automated brute force: random values entered into Shinhan’s loan-broker service to find valid customer numbers, with other details extracted afterward. It says authorities read the pattern as “AI randomly attacking multiple financial firms, with those having weaker defenses being breached, rather than a targeted strike on specific companies.”

The Logpresso Link, and What It Does Not Prove

Per the Korea Herald, Logpresso’s report, released Sunday, found that the Telegram account CrowdStrike published was listed in September 2024 as a moderator of an online community called GodNet. The community was created by Vitas, “a Chinese group that carries out DDoS attacks for paying clients.” The Herald says the work compared Telegram and GitHub records with data stolen by infostealer malware. It traced a second account on the GodNet staff list through GitHub code that connected a Telegram account to a GodNet domain name, and traced an email address in the code’s edit history to login details an infostealer took in 2023, including logins for Microsoft and Oracle cloud services. That second person has not been directly linked to the bank hacks. Logpresso says investigators could identify that person by comparing the stolen logins with cloud providers’ subscriber records, which could also help trace whoever is behind the first account.

The caveats are in the same account. In the Herald’s words, Logpresso said “the account links alone do not establish who carried out the hacks,” and it could not conclude that only one person was behind the breaches. The account CrowdStrike named was deleted on October 8, and a new account under the same username appeared with a channel posting a denial of involvement; the Herald says it is unclear whether one person controls both. The Hacker News quoted that channel as saying “I didn’t do anything,” which I could not verify. The owner of the phone number in CrowdStrike’s report also denied involvement, saying someone had used the number without permission. CrowdStrike’s own conclusion is that “currently available information cannot definitively associate these details with the threat actor.”

ARTEX After the Closure

ARTEX’s developer, who uses the GitHub handle Autumn-27, said on October 8 that the project “will no longer be updated and will be converted to a closed source,” and, per The Hacker News, said the attacks had nothing to do with them. The statement says ARTEX “was originally designed for the purpose of learning and research.” Reuters adds that the project’s GitHub page said the tool was meant for personal learning, code research and local technical verification, not for real-world testing of online systems. Kyunghyang reports a first release on July 26, a first-place finish among about 150 teams in a Baidu-hosted offense-defense contest on September 3, and a latest version on September 24, three days before the reported intrusion at KB Kookmin began.

Closing the source does not recall copies. At about 10:10 UTC on October 11 the original repository’s API address returned HTTP 404, while GitHub’s repository search listed 91 public repositories with ARTEX in the name created since October 7. I counted names, so a few will be unrelated, but most of the first 30 results describe themselves as source backups, mirrors, Korean or English builds, or derivative forks, and most carry an AGPL-3.0 license. The most-starred had about 3,000 stars after three days. BleepingComputer likewise reports English- and Korean-language derivatives. I am not linking to any of them.

What Regulators Told Firms to Do

The Financial Services Commission ordered an industrywide security review. According to the JoongAng Daily, firms were told to identify IT assets and services, including AI systems, that are readily accessible from outside and check them, to look for any pathways that could allow access to internal information without authentication, and to share attack IP addresses and intrusion records with agencies including the Korea Internet & Security Agency. The commission’s chairman said: “We must hurry to put security that uses AI in place to defend against AI attacks.” The Korea Times reports that police identified 28 IP addresses connected to the attacks, most of them used to conceal the attacker’s traces, that the National Assembly’s Policy Affairs Committee approved summoning the heads of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup for an October 19 audit, and that financial authorities are weighing easing network separation rules to strengthen AI-based defenses.

What to Watch

• Whether Korean police and the firms confirm ARTEX in each intrusion. The Herald says authorities “suspect” the attacker combined multiple AI models, including DeepSeek, with ARTEX.
• Whether Logpresso’s proposed comparison with cloud providers’ subscriber records leads to an identification that investigators can test.
• The October 19 audit and any compensation or rule changes the Financial Services Commission announces.
• Any statement from Anthropic, and any detail on which models answered the prompts CrowdStrike attributes to Claude.
• Whether the exposed data shows up in the phishing and loan scams that the Financial Services Commission and Financial Supervisory Service have warned consumers about.

For earlier coverage of attackers working with AI agents and assistants, see our reports on a Russian state-linked group that used Claude to rebuild malware until it evaded detection, the Carbonato Docker botnet that runs an unmodified open-source AI agent, and CLOSEDQUORUM, the Cisco Talos malware that lets four chatbots vote on its next step.