ARTEX automates secret discovery and is linked to breaches at seven South Korean financial institutions

A Hunt.io investigation reconstructed the infrastructure of ARTEX, an open-source autonomous penetration testing framework developed in China, linking it to breaches at seven South Korean financial institutions that occurred between late September and early October. The incidents exposed the personal, employment, income, and credit data of approximately 66,000–67,000 individuals and 2,200 companies. CrowdStrike assessed with moderate confidence that the campaign was carried out by a single financially motivated Chinese-speaking operator rather than an organized group. The environment primarily used DeepSeek v4.1 Flash, with GLM 5.3 and Grok 4.6 as alternative models, as well as proxies and publicly accessible servers. Subsequent reports indicate that ARTEX is also being used to quickly identify and exploit secrets left in public GitHub repositories, drastically reducing the time between exposure and compromise. Organizations must therefore treat every published credential as already compromised, revoke it immediately, and strengthen preventive scanning, rotation, and privilege restrictions.

Source: Security Affairs