Exposed ARTEX Infrastructure Reveals AI-Assisted Tooling Linked to South Korean Bank Breaches

Hunt.io uncovered exposed infrastructure associated with an ARTEX-enabled campaign that reportedly breached seven South Korean financial institutions in late September and early October 2026. Investigators linked a previously reported ARTEX console at 38.244.50[.]120 to a Hong Kong jump server at 23.248.226[.]250, where an open directory exposed credentials, Claude Code configurations, model-routing scripts, remote-access tools, and 19 custom agent skills. The configurations referenced alternative AI backends including DeepSeek, GLM, and Grok, with skills supporting reconnaissance, web application testing, payment-logic analysis, and mobile operations.

Recovered material also included reverse SSH tunneling utilities, JNDI/LDAP exploitation artifacts, Linux exploit binaries, cryptocurrency-related scripts, and mobile-device tools, although their direct use in the reported bank breaches remains unconfirmed. Additional infrastructure included FOFA-related tooling and a proxy service at 154.201.79[.]246:443; testing 100 proxy identities returned 79 unique exit IP addresses, illustrating the breadth of available network egress. Broader searches identified additional ARTEX-associated infrastructure candidates, but researchers cautioned that these findings do not establish common ownership or campaign involvement across all hosts.