Developer closes the source code

On Thursday, 8 October, the developer behind ARTEX, posting under the GitHub handle "Autumn-27", said the project would no longer be updated and would be converted to closed source. No new versions will be released to the public and no maintenance support will be provided. ARTEX was released on GitHub earlier this year as an open-source AI agent designed to automate penetration testing. It does not run its own large language model but connects to external models such as ChatGPT, Claude and DeepSeek to help organisations test their networks for vulnerabilities. The developer said the tool was meant to help enterprises conduct security risk testing, opposed any illegal use and bore no responsibility for conduct that violates laws and regulations. The developer did not address the South Korean bank attacks directly, and the ARTEX GitHub page has already been taken down.

Attacks on South Korean banks

Security firms identified ARTEX as a tool used in a recent cyberattack campaign against South Korean banks. At least nine South Korean banks have disclosed or been reported by local media as targets since late September, and police launched a probe this week. The government's count differs: on Tuesday it said ARTEX had very likely been used in breaches at seven financial institutions, including large banks, while AFP reported the figure as more than seven. The Financial Services Commission says more than 68,000 people have been affected. Shinhan Bank said information attached to loan applications for about 25,000 customers was leaked, including names, phone numbers and annual income. On Tuesday, President Lee Jae Myung said:

the scope of the damage is spreading across all areas on a scale that is difficult to compare with the past

Who is behind the campaign

CrowdStrike said on Wednesday that the suspect was likely a China-based 26-year-old who used ARTEX and Anthropic's Claude Code, and assessed the individual as pursuing financial gain. Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, described the attacker's skill level:

While (the hacker's) capabilities were not terribly sophisticated they were effective

CrowdStrike said the campaign would probably not have been possible without AI assistance. Financial Services Commission chairman Lee Eog-weon said on 4 October that AI use could not be ruled out, and two days later President Lee Jae Myung said signs of its use had appeared in some incidents. Authorities have not detailed which tools were used or reached a definitive technical attribution. China's foreign ministry spokesperson Mao Ning said on Thursday that the ministry was not familiar with the case and that China consistently opposes and combats hacking.

Japan and the wider wave

Japanese companies including Daiwa Securities, SoftBank Corp and the Lawson convenience store chain have been hit by a recent surge in cyber incidents. Around 20 companies have said their data may have been compromised, potentially affecting millions of customers. Japan police chief Yoshinobu Kusunoki said on Thursday that it was not clear what the background to these cases is or whether there are links between them. TrendAI data show Japan recorded more cybersecurity incidents in the first nine months of the year than in all of last year, with 86 incidents in September, up about 18% from August. Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, said:

AI doesn't get tired... My view is that Japan is essentially being subjected to carpet bombing

Authorities in both countries are still investigating whether and how AI was used in many of the breaches.