The same tool raided South Korean banks — its servers leaked the attackers' own session logs

The Japan finding extends documented ARTEX use beyond a campaign against South Korean financial organizations. CrowdStrike reported that ARTEX and large language models were used against South Korean banks from late September to early October, with data exfiltrated — and the attacker's own servers exposed open directories holding Claude Code session histories and ARTEX configuration files, including a Chinese-language pentesting prompt.

CrowdStrike assesses the attacker was likely a financially motivated Chinese speaker, but neither it nor GMO attributes the Japanese and South Korean campaigns to a named actor. GMO says AI lets attackers find vulnerable software versions that vulnerability notices don't list and dodge web-application firewalls by spreading requests across hundreds of IP addresses.