The attacker who breached South Korean banks asked Claude where stolen Korean data sells.

And Officials believe an open-source Chinese agent helped breach at least 7 South Korean financial institutions.

The attacker’s own Claude Code session histories, Claude memory files and ARTEX configurations sat in open directories, giving a direct view of how an AI-assisted intrusion campaign against South Korean finance was run.

ARTEX, a recently released Chinese open-source agentic pentesting tool, ran on DeepSeek v4.1-flash, likely reached through an API reseller, from a host that probably carried out the Korean attacks.