The credential file came with instructions. Keep its permissions restricted. Never paste the secrets into an AI session. The threat actor had taken the trouble to protect the passwords from accidental disclosure, then left the directory containing them exposed to the public internet. CrowdStrike's original account of the ARTEX intrusions had already recovered the absurd request for an AI-written security-researcher resume built around the South Korean bank intrusions. Hunt.io found the rest of the workbench, including the credentials, reverse SSH tunnels, AI configuration, and tools used to keep the operation running.
This updates our earlier analysis on ARTEX, where an unidentified, likely financially motivated threat actor used a Chinese-developed penetration-testing framework and commercial AI models in a campaign linked to breaches at seven South Korean financial institutions. Hunt.io has now mapped the infrastructure behind that campaign, with additional reporting on the exposed servers. What initially looked like a remarkable failure of operational security has become a detailed record of how the adversary assembled and maintained the entire environment.
Workbench Left in the Open
Hunt.io started where CrowdStrike and Genians stopped, at the ARTEX control server already published at 38.244.50[.]120. From there it pivoted. A search of its own scanning platform tied that address to an open directory on a Hong Kong jump host at 23.248.226[.]250, holding 42 files across two subdirectories. About 105 megabytes of the adversary's working data had been left accessible.
What the directory held reads like a reproducible build of the operation. A Claude Code state file records version 2.1.221 started 510 times since August 4, and it was not communicating directly with Anthropic. Two proxy shims handled the model routing. One forwarded requests straight to DeepSeek's API. The other injected a reasoning parameter and passed its traffic through Claude Code Router and the reseller xcai[.]pro.
A credentials file named .secrets, holding keys for Zhipu AI's GLM, an OpenAI-compatible relay, and the Webshare proxy service, described itself in a Chinese comment as the sole source of credentials. A tunnel named grok2api sat beside it. The model backends match CrowdStrike's findings, with DeepSeek as the primary model and GLM and Grok used for additional sessions.
The tradecraft around the models is ordinary and sloppy in equal measure. Three scripts keep a reverse SSH tunnel alive using a root login, run a local relay, and copy the AI's memory files to the jump host. Nineteen custom skills, used 147 times between them, cover code audit, reconnaissance, injection, web-application-firewall bypass, authentication, and payment logic. Three self-registered test accounts hold tokens for a cash-in deposit API, dated September 12, with a comment calling them an authorized self-built test. That label is the adversary's claim, not a verified fact.
Those counters describe activity inside the AI environment, not successful intrusions. The 510 Claude Code startups and 147 recorded skill invocations cannot show how often the tools were turned on the Korean institutions, or how many attempts succeeded.
A FOFA asset-search script and a rotating proxy at 154.201.79[.]246 provided further reconnaissance infrastructure. The proxy yielded 79 unique exit addresses across its first hundred tested identities. A staged JNDI and LDAP exploitation setup, retrieved on October 5 at 03:42 UTC, rounds out the kit. Its logs included a DNS callback consistent with successful remote command execution, though the evidence does not tie that execution to the Korean bank compromises.
Exposure Was Self-Inflicted
AI lowers the cost of offensive work, and the infrastructure behind it can become more visible, but the second half is conditional, and ARTEX shows exactly how conditional.
The visibility here is not a property of using AI. It is a string of ordinary mistakes. The adversary left administrative services and open directories reachable from the public internet, stored a credentials file in an accessible directory, held SSH tunnels open as root, and copied the AI's memory files onto a jump host anyone could scan. Hunt.io reconstructed the operation because the doors were open, not because the models betrayed anyone.
The AI stack did leave additional forensic evidence. Claude Code preserved operational context, and configuration files recorded the scripts and services wiring the models together. The adversary used Claude Code as an interface but sent its requests through alternative model services, including a reseller fronting DeepSeek, so the activity bypassed Anthropic. That choice changed where requests were processed and potentially where they could be monitored. Neither CrowdStrike nor Hunt.io confirmed whether avoiding provider scrutiny motivated the configuration. What investigators recovered came from exposed infrastructure, not a model provider disclosing private conversations.
The recovered tooling also reaches past the bank intrusions. It includes cryptocurrency, Linux privilege-escalation, and mobile-device artifacts whose direct involvement in the South Korean breaches is unconfirmed. An exposed workbench can reveal the tools used to prepare an intrusion without preserving a complete history of what happened inside each victim environment.
Framework Outlived the Exposure
None of this reconstruction removed ARTEX from circulation. Hunt.io's wider infrastructure searches returned 1,303 distinct IP addresses classified as ARTEX across 30 countries, and an HTTP title search identified roughly 1,300 matching addresses. A narrower AttackCapture search returned 280 results covering ARTEX panels, exposed services, and directories flagged as malicious.
The numbers show substantial infrastructure exposure, but they do not amount to 280 active installations or 1,303 malicious deployments. Other hosts carried exploitation kits for DedeCMS, FangCMS, and RuoYi, along with CAPTCHA-bypass tooling and SMB reconnaissance. The scale recalls earlier investigations into hundreds of autonomous agents operating across international targets, though those campaigns ran on different frameworks and methods.
Hunt.io is explicit that the geographic distribution describes where the observed infrastructure is registered, not where the adversaries operate, and its broader results cannot be tied to the Korean intrusions. The victim figures, roughly 66,000 to 67,000 individuals and about 2,200 corporations, come from earlier reporting rather than Hunt.io's own scanning. CrowdStrike's assessment of a single Chinese-speaking, financially motivated individual sits at moderate confidence, and the person behind it has not been definitively identified.
The automated component is cheap, and that is what makes the spread durable. In a separate investigation, AI-assisted intrusion workflows cost as little as US$0.40 to US$4 in model usage per victim. Those figures do not fix ARTEX's own operating costs, and infrastructure, credentials, proxy services, and skilled human direction still carry a price. But the technical work once demanding substantial manual effort is becoming easy to package and repeat.
State-Aligned Adversaries Adopt the Framework
The clearest evidence that ARTEX has spread beyond one financially motivated individual comes from two reports published in late October. On October 21, Microsoft attributed a ConnectWise-linked campaign to Storm-0940, a China state-aligned adversary active since 2021. Microsoft assesses that Storm-0940 was behind the ConnectWise Cloud Backup supply-chain compromise, and that it has run ARTEX against hundreds of organizations since as early as September. After seizing control of application credentials, the adversary used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 customer tenants.
Microsoft recorded multiple instances where ARTEX-assisted activity reached privileged cloud access in under three hours. Some successful sign-ins moved into Microsoft Graph operations, including reconnaissance, application credential changes, and privilege modifications that could persist as a backdoor. Microsoft's detection findings also included an application assigning itself the Global Administrator role. Microsoft cautioned that the majority of the targeting failed, that an attempted sign-in does not prove a successful compromise, and that even successful authentication does not mean customer data was accessed or taken.
Eight days later, CrowdStrike reported VAPOR PANDA using ARTEX against more than 200 organizations worldwide from October 17. The targets included foreign ministries across Latin America, Europe, Asia, and the Middle East. CrowdStrike also named a United States semiconductor manufacturer, defense organizations, think tanks, and telecommunications providers. It confirmed post-exploitation activity at nine organizations, with password-spraying and credential-scanning against at least twelve more, and the deployment of the BLOODALCHEMY backdoor.
These operations are separate from the South Korean financial intrusions, and their existence does not prove a common adversary. They do show something the infrastructure counts cannot. Different adversaries, from financially motivated eCrime to China-nexus espionage, have folded the same framework into distinct operations spanning financial systems, cloud infrastructure, and intelligence collection.
Capability Outran the Takedown
The original ARTEX GitHub repository and Docker image were removed on October 11. Forks and mirrors stayed available, and other adversaries had already built the framework into operations reaching well beyond the Korean financial sector. Pulling the original distribution channels changed none of that.
The gap between disrupting an operation and removing its underlying capability is familiar from earlier work on infrastructure seizures and reusable criminal business models. ARTEX is not a ransomware-as-a-service operation, and the comparison should not be read as one. The shared problem is the durability of reusable tooling after the original infrastructure or distribution channel disappears.
Hunt.io recovered a remarkably detailed view of one adversary's environment, down to its credentials, model-routing infrastructure, proxy arrangements, exploitation tooling, and accumulated AI memory. It did not identify the person behind the keyboard, map the full extent of the Korean compromises, or count how many other installations were being used maliciously. Those limits do not diminish the intelligence value of the discovery. They define what it can actually tell us.
Investigators can reconstruct this operation down to the passwords and the instructions written to protect them. They can trace the infrastructure, document the tradecraft, and make life considerably harder for the adversary who exposed it. Knowing how a tool works is not the same as taking it away, and the offensive capability has already moved into other hands, including adversaries operating at a scale far beyond the Korean financial intrusions.
The original repository disappeared. The threat actor left a workbench open to the internet. Investigators recovered extraordinary evidence from both, but neither prevented the framework from being used elsewhere. The next adversary does not need the original repository, the exposed infrastructure, or the person who left it behind.
The next adversary only needs a copy.