Korean bank hacking abuse situation 'ARTEX'... Open AI security tool developed in China

(San Francisco = Yonhap News) Correspondent Kwon Young-jeon = 'ARTEX AI', which was revealed to have been used to hack Korean financial companies, is a cybersecurity tool developed in China, but hackers appear to have abused it to attack banks, the Wall Street Journal (WSJ) reported.

On the 6th (local time), WSJ highlighted China's open source cyber security tool, ARTEX.

ARTEX is an open AI agent developed by Chinese cybersecurity engineer Li Puhua, who goes by the nickname 'Autumn'.

Although this agent is not an artificial intelligence (AI) model itself, this tool allows you to load other AI models and use them as if they were team members.

For example, Antropic's Claude, OpenAI's GPT, and China's AI model DeepSeek are imported and used on ARTEX.

The developer originally created this tool for cybersecurity purposes to help various organizations identify network vulnerabilities, but hackers appear to have abused it to carry out security attacks using AI models.

Such abuse was possible because the tool was open and anyone could download it for free, modify it for their own purposes, and use it.

After the bank hacking incident was reported, ARTEX specified in its user guidelines that it should not be used for malicious purposes such as unauthorized cyber intrusion or data theft.

However, this is only a declarative measure and is not a means to fundamentally prevent cyber attacks and other abuses by users who wish to commit crimes.

“Cybersecurity attacks using AI agents are increasing in Korea,” said Jonghyun Moon, director of Genius Security Center, a Korean cybersecurity analysis company. “The number is expected to increase globally as well.”

ARTEX attracted attention by winning the agent-type AI system competition for cyber security attack and defense held in China last month.

This attack on a Korean financial company was carried out through 20 IP addresses in 10 countries, including the United States, Japan, and Germany, to avoid tracking.

The identity of the suspect has not yet been identified, but the Chinese character string 'ARTEX-自主渗透試控制台' was confirmed on some of the web servers used in the attack.