ARTEX AI is a free program built to help companies find their own weak spots before criminals do. Investigators found its fingerprints on a server used in attacks on seven South Korean financial companies, including Shinhan Bank, KB Kookmin Bank and Hana Bank, between September 27 and September 30, according to Kyunghyang Shinmun.
The strangest part of the story is where the attackers got in. It was not the banking app millions of people use every day.
At Shinhan, the door was a small web page for loan brokers. These are outside salespeople who sign customers up for loans and then check on each application’s progress. The attacker kept typing in random customer numbers until real ones came back. Then they pulled names, phone numbers, yearly income and credit limits for 25,727 people. At KB Kookmin, the door was a phone app that employees use for work. Hana’s was a sales-support system. None of these are the vault where deposits and transfers live. They are side doors that staff and partners use, and they were less guarded.
So what does the tool actually do? Banks pay security firms to run “penetration tests.” A friendly hacker tries to break in on purpose and writes a report on what worked. ARTEX AI tries to automate that job with an AI agent, meaning an AI that takes actions on its own instead of only answering questions. (Robinhood is now letting AI agents trade for customers too. Same idea, different job.) This one scans a system, looks for weaknesses, plans a route in and runs the tools. The code is posted publicly on GitHub, written in Chinese.
The clue on the attack server was its page title, a Chinese phrase meaning “AI autonomous penetration testing console,” BleepingComputer reported. Officials have not confirmed the tool was used. But the timing is hard to ignore. The latest version of ARTEX AI was published on September 24. The first attack, on KB Kookmin, started three days later.
The numbers outside Shinhan look small. KB Kookmin lost data on 119 customers, Hana on 89, and BNK Busan Bank on 11 outside developers. Woori Bank and NH NongHyup Bank saw attempts but say nothing got out. Small numbers can still hurt, though. A name, a phone number, an income and a loan limit is exactly what a phone scammer needs to sound like your bank.
Regulators moved fast. On October 2, the Financial Services Commission called an emergency meeting and told banks and card companies to list every system that can be reached from the internet. They must also check for any path into internal data that skips a login. On October 4, President Lee Jae Myung ordered a full investigation. Police are still trying to find out who did it.
The lesson is not really about China, or even about AI. A tool made for defenders is free to download, and it worked best against the doors nobody watched closely.
My take: The vault was locked. The side door wasn’t.
Not advice. Just how I see it.