Recommended Free Tools
CrowdStrike says a campaign targeting South Korean financial organizations from late September to early October 2026 used the open-source ARTEX penetration-testing tool alongside large language models and resulted in data being exfiltrated. A résumé prompt found in exposed coding-tool session data described a possible suspect in China, but CrowdStrike says those details do not definitively identify the person behind the activity.
What CrowdStrike says happened
In a report published October 7, 2026, CrowdStrike Intelligence described infrastructure it associated with a campaign targeting South Korean financial organizations. The activity ran from late September to early October, and CrowdStrike says data was exfiltrated. The company had not confirmed how many organizations were affected. CrowdStrike’s report is the primary technical account.
As an Amazon Associate I earn from qualifying purchases.
Separately, Reuters reporting published by The Straits Times said South Korean authorities were investigating attacks affecting financial institutions and that Shinhan Bank and KB Kookmin Bank had reported breaches. Those bank names and the investigation status come from Reuters’ account; CrowdStrike’s report describes financial organizations generally and does not confirm the involvement of each named bank. Read the Reuters report published by The Straits Times.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhat role did ARTEX and AI tools play?
CrowdStrike describes ARTEX as a recently released, open-source agentic penetration-testing tool developed in China. Its analysis of ARTEX configuration files and Claude Code session histories says the ARTEX instance used DeepSeek v4.1-flash as its primary large language model backend. Other Claude Code sessions included references to GLM-5.3 and Grok 4.6.
#1 Best Overall
These are details CrowdStrike reported from the materials it analyzed. They show that the campaign involved AI-related tools; they do not establish that the models’ providers participated in the operation or that an AI model independently carried out the intrusion. The reported evidence includes tool configurations and session histories, and the campaign resulted in data exfiltration.
Why CrowdStrike mentioned a possible 26-year-old suspect
Among the session data CrowdStrike examined was a request to create a security-researcher résumé listing results from ARTEX-related activity. The prompt reportedly included personal details such as a name, age, education and a location in Maoming, Guangdong, China. CrowdStrike says those details likely belong to the actor responsible for the ARTEX-related activity, but it cannot definitively associate them with that actor.
Rank #2
- PREMIUM-QUALITY RECORD BOOK FOR DEALERS & COLLECTORS: Clever Fox Firearms Record Book is designed to help professional firearm dealers keep detailed and legally compliant acquisition and disposition information.
- 129 PAGES WITH 1,342 NUMBERED ENTRIES TOTAL: There are 129 pages in this firearm log book with 1,342 numbered entries total. Each pre-printed entry allows you to record the firearm’s description, as well as receipt and disposition info.
- LARGE FORMAT & PLENTY OF SPACE FOR EVERY DETAIL: This firearm record book comes in large format and measures 10 by 7 inches, so you have lots of space to make detailed records and add all the information you need.
- STORAGE POCKET, DURABLE HARDCOVER & THICK NO-BLEED PAPER: This gun record book features a pocket for loose papers, a pen loop, an elastic band, and a bookmark. The hardcover is made of durable vegan leather. The pages are thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE: We will exchange or refund your book of firearms if you aren’t satisfied with your personal firearms record book for any reason. Reach out to us via message to refund your personal gun log book.
The age is especially uncertain: the prompt reportedly listed 26, but also gave a birth date of September 22, 2007. That date would make the person 19 in October 2026. Neither the age nor the identity should be treated as verified. CrowdStrike’s report does not establish that the person described in the prompt carried out the attacks.
CrowdStrike also noted that the same Telegram username appeared in separate vulnerability-research activity involving a Telegram-based NFT gift marketplace and activity targeting a possible Chinese payment platform. That connection is part of the company’s analysis, not definitive proof identifying the person behind the South Korean campaign. The account does not reproduce the personal phone number or handle.
Rank #3
How certain is the attribution?
CrowdStrike did not attribute the campaign to a named adversary or state. It assessed, with moderate confidence, that the actor was likely a Chinese speaker and financially motivated. The company cited ARTEX’s Chinese development and Chinese-language prompts as part of its assessment.
Those indicators are not proof of nationality, state direction or individual identity. CrowdStrike’s Ashley Campion wrote: “While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated.” The qualification about moderate confidence is central to interpreting that assessment.
Quick Recap
What is known—and what remains unconfirmed
- Reported by CrowdStrike: a campaign targeting South Korean financial organizations, activity from late September to early October 2026, ARTEX and LLM use, and data exfiltration.
- Not confirmed in CrowdStrike’s report: the total number of affected organizations, a definitive identity for the actor, or attribution to a named group or state.
- Reported separately by Reuters: South Korean authorities were investigating attacks affecting financial institutions, with Shinhan Bank and KB Kookmin Bank among banks that reported breaches.
- Distinct from the campaign findings: Reuters also reported that President Lee Jae Myung commented on signs of AI use in some hacking incidents and called for stronger cybersecurity measures; that statement is not a technical finding about this specific operation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
