Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
Goran P. — Information Security Lead
Agentic pentesting tools are no longer confined to security labs.
CrowdStrike found ARTEX configurations, Claude Code histories and model prompts on infrastructure connected to attacks against South Korean financial organisations.
The interesting part for me is the workflow. The actor combined an autonomous testing tool, several models, proxy infrastructure and conventional offensive techniques.
I would start hunting for the automation around the intrusion, not only the final payload.
Can your detections distinguish a developer running an AI security tool from an attacker doing the same thing?
https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
#ThreatDetection #AISecurity #FinancialSecurity
6 reactions · 1 comments
Topics: #financialsecurity, #aisecurity, #threatdetection
Comments
Schomer: This is the ultimate blind spot for traditional security stacks. Trying to train downstream analytics to 'distinguish' an authorized developer from an agentic attacker running the exact same Claude Code tool paths is an engineering dead-end [Other Google Activities, Other Claims]. If your detection strategy relies on parsing human or machine 'intent' at the application layer, a sophisticated auton