Threat reportThreat IntelligenceTL-2026-3860
TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in AI-Assisted Attacks on South Korean Financial Institutions
TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in (TL-2026-3860), also tracked as ARTEX-assisted South Korean financial campaign, is a high-severity tracked intrusion set, first published 2026-10-19 and last reviewed 2026-10-21. It is attributed to TAG-217 with low confidence, affects Various South Korean financial institutions (Shinhan Bank, KB Kookmin, maps to 16 MITRE ATT&CK techniques (T1046, T1059, T1059.004), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1TAG-217
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-3860
- Threat ID
- TL-2026-3860
- Also known as
- ARTEX-assisted South Korean financial campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- TAG-217
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 40
- Updates
- 2026-10-21 · 2 updates · revalidated 2× · latest source
Malware and tooling in TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in
Malware and tooling: GROK, ARTEX, Claude Code, DeepSeek v4.1-flash, GLM-5.3, Grok 4.6, YiiMP
How TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in works
Recorded Future's Insikt Group tracks TAG-217, a suspected Chinese-speaking actor (not confirmed as state-backed), using AI tools (Claude Code, DeepSeek, Grok, Zhipu AI GLM) and the Chinese-language agentic penetration-testing framework ARTEX against at least seven South Korean financial institutions. Personal information of roughly 68,000 people was reported exposed.
In October 2026 Recorded Future's Insikt Group (report of 2026-10-16) described TAG-217, a suspected Chinese speaker who is not confirmed as a state-backed group, using commercial and open AI services together with ARTEX, an open-source Chinese-language framework for automated security testing, against South Korean financial organizations. Exposed files on actor-controlled infrastructure revealed the preparation workflow: infrastructure testing and scanning of internet-facing systems from 2026-08-17 to 2026-08-22, assembly of cryptocurrency-targeting toolkits on 2026-08-22, creation of an iPhone/Android mobile testing environment on 2026-09-05, and operational AI tooling plus reconnaissance infrastructure by 2026-09-26. Recorded Future states that the exposed files showed preparation but did not confirm successful bank intrusions, and that deployment of the mobile and crypto tools was unconfirmed.
Observed tradecraft includes routing traffic through residential proxies, YiiMP-targeting scripts that try default passwords and send Telegram alerts, cryptocurrency wallet-stealing tools, Linux privilege-escalation exploits, and mobile device testing. AI services named across reporting are Claude Code, DeepSeek, Grok and Zhipu AI. Recorded Future states that basic operational security mistakes left a trail.
CrowdStrike Intelligence independently reported (without using the TAG-217 name) infrastructure tied to a campaign against South Korean financial organizations, active from late September to early October 2026, in which data was exfiltrated. It assessed with moderate confidence that the actor is a financially motivated Chinese speaker, based on use of ARTEX and Chinese-language prompts. Open directories held Claude Code session histories, ARTEX configuration files and Claude memory files. These showed a two-server architecture (an ARTEX/Claude Code host at 38.244.50.120 plus separate attack infrastructure), nine proxy IPs, and the LLM API proxy xcai.pro, likely a DeepSeek API reseller. The LLM backends were DeepSeek v4.1-flash (primary), GLM-5.3 and Grok 4.6. The session records indicate the actor had no specific monetization plan and asked Claude to suggest Korea-focused Telegram data-sale groups. Whether CrowdStrike's activity and TAG-217 are the same actor is not established in the sources reviewed.
South Korean press and AhnLab reporting (2026-10-06) cites seven financial firms and about 68,000 people's data exposed, and says AhnLab's Security Intelligence Center observed ARTEX instances on roughly 600 IPs worldwide. That count does not establish that each server was used in an attack or run by the same group. South Korea's National Police Agency is investigating. Banks reported as affected include Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank and Yegaram Savings Bank; exfiltrated data included personal and credit-card information, and outages were reported. A trace of ARTEX on an attack server does not by itself confirm that an AI agent conducted the intrusion. The ARTEX developer reportedly made the project closed-source after the real-world attacks, though derivatives remain available. Recorded Future states that detailed campaign IoCs are in its customer intelligence-platform note, so the public IOC set here is limited to what CrowdStrike published.
MITRE ATT&CK techniques used in TL-2026-3860
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter
Command and Control
T1090 Proxy; T1090.002 Proxy; T1572 Protocol Tunneling
Credential Access
Collection
Initial Access
T1190 Exploit Public-Facing Application
Exfiltration
T1567.002 Exfiltration Over Web Service
Resource Development
T1583.003 Virtual Private Server; T1588.002 Tool; T1588.007 Artificial Intelligence
Reconnaissance
T1590 Gather Victim Network Information; T1595.001 Scanning IP Blocks; T1595.002 Vulnerability Scanning
Affected products and versions in TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in
- Various — South Korean financial institutions (Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, and others; at least seven firms)
Remediation for TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in
Immediate actions
- Block and hunt for the published infrastructure (38.244.50.120, xcai.pro and the listed proxy IPs) in firewall, proxy, DNS and NetFlow logs
- Identify and secure internet-accessible services and review exposure of employee and partner mobile work systems
- Monitor for unusual sign-ins, unexpected credential requests and unexpected remote access
Workarounds
- Remove default credentials from internet-facing services such as mining-pool software
- Restrict management interfaces to VPN or allow-listed addresses
Longer-term hardening
- Audit access permissions on employee and partner applications
- Link external infrastructure intelligence with internal anomalous-activity patterns
- Alert on automated, high-rate scanning and default-credential attempts consistent with agentic penetration-testing frameworks
- Apply Linux kernel and OS patching to reduce exposure to public privilege-escalation exploits
Timeline of TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in
- Earliest operator prompt history recovered by Zscaler ThreatLabz, showing ARTEX and multi-model AI-assisted targeting of web and Android apps.
- Recorded Future reports the start of infrastructure testing and scanning of internet-facing systems (window 2026-08-17 to 2026-08-22).
- Cryptocurrency-targeting toolkits (wallet-stealing tools, YiiMP-targeting scripts with default-password attempts and Telegram alerting) were assembled.
- Mobile testing environment (iPhone and Android) was created.
- Intrusions against South Korean financial institutions begin in late September 2026 (exact day not stated; date approximate).
- AI tools and reconnaissance infrastructure were operational, per Recorded Future's reconstruction from exposed files.
- Custom ARTEX Docker image artex-local:perf2-20261003 tagged on the operator's work environment.
- Latest operator prompt history entry recovered by Zscaler, ending a roughly two-month activity span.
- AhnLab reported ARTEX instances on about 600 IPs worldwide while South Korea's National Police Agency investigated attacks on seven financial firms (about 68,000 people's data exposed).
- CrowdStrike publishes analysis linking 38.244.50.120 (ARTEX host with exposed Claude Code files) to exfiltration from South Korean financial organizations.
- Telegram account @YY520CN, referenced in the attacker's prompt files, is reported deleted.
- ARTEX developer Autumn-27 announces the open-source edition will no longer be updated and will become closed source, stating the attacks had nothing to do with them; the GitHub repository is taken offline.
- A report links @YY520CN to the Vitas DDoS group's GodNet community, cautioning that the links do not establish who carried out the intrusions.
- ThreatBook launches RedAgents, a SaaS pentest aggregator that includes Artex Pro (the commercial ARTEX edition); press links ARTEX's origin to a ThreatBook engineer.
- Recorded Future Insikt Group published its report on TAG-217 and its AI-assisted targeting of South Korean financial institutions.
- GBHackers, BleepingComputer and CrowdStrike published reporting on the campaign, including Claude Code session histories, ARTEX configs and infrastructure IOCs.
- Zscaler ThreatLabz publishes its analysis of the operator's environment, showing targeting across 19 countries; detected as AI.HackTool.ARTEX.
Update history for TL-2026-3860
- 2026-10-21 — Global AI-Assisted Hacking Campaign by Chinese-Speaking Operator Using ARTEX Framework and Multi-Model LLM Orchestration: What changed No severity, exploitability or status change (already HIGH / ACTIVE). Scope widened: Zscaler documents targeting of organizations in 19 countries across many sectors, beyond South Korean finance. New indicators (13) Operator wo
- 2026-10-20 — ARTEX Agentic AI Pentest Tool Misused in Attacks on South Korean Financial Institutions; ThreatBook Launches RedAgents Multi-Agent Platform Incl. Artex Pro: What changed No severity, exploitability or status change; the existing HIGH / ACTIVE / LOW-attribution values already match the newer report. Added context on attack paths (a bank's loan-progress inquiry service and another bank's employee
Sources cited for TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in
- Hackers Use Claude, DeepSeek and Grok in AI-Assisted Attacks on South Korean Banks
- Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike)
- Hacker used ARTEX AI and Claude agents to target South Korean banks (BleepingComputer)
- AhnLab finds ARTEX on 600 IPs as police probe South Korean bank breaches
- AI-powered attacks on South Korean financial sectors linked to Chinese DDoS group: report
- ARTEX GitHub repository (as cited by RuntimeWire)
Detection coverage for TL-2026-3860
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3860 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.