Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions

Introduction

Zscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. First observed in late September 2026, the campaign affected multiple South Korean financial firms and resulted in the exfiltration of personally identifiable information (PII) belonging to approximately 67,000 individuals.

ThreatLabz assesses with moderate confidence that the campaign is the work of a financially motivated, Chinese-speaking threat actor. The threat actor exploited peripheral internet-facing web applications, including customer-facing inquiry portals and employee-facing mobile application backends.

Recommendations

The threat actor used AI to support reconnaissance and exploitation in this campaign. ThreatLabz recommends the following practices to strengthen defenses against AI-assisted attacks. For additional context on AI-driven security testing, see our blog: When the Scanner Starts Thinking: Learnings from Mythos & GPT 5.5 Cyber in Security Testing.

1. Reduce application exposure: Reduce your external exposure by moving your applications behind a Zero Trust access solution, like Zscaler Private Access (ZPA). 
2. Understand your assets and associated risks: Establish complete visibility into internet-facing and internal assets, including AI assets, and assess their exposure and vulnerabilities to prioritize remediation. Zscaler’s AI Asset Management, Asset Exposure Management, External Attack Surface Management, and Unified Vulnerability can support these efforts.
3. Deploy deception controls: Use Zscaler Deception to detect suspicious reconnaissance and access attempts through decoy assets and accounts. Configure automatic containment to restrict the associated asset or identity’s access to production applications while capturing activity in the decoy environment.
4. Prioritize Zero Trust everywhere architecture: Apply Zero Trust consistently across remote and on-premises environments. Enforce least-privilege user-to-application access to limit lateral propagation and reduce the blast radius from AI-driven attacks.
5. Use AI red teaming and guardrails for your production models: Use AI red teaming and guardrails to assess susceptibility to prompt injection and unsafe outputs. Monitor for hallucinations and model drift over time.
6. Use AI-powered exposure management: Use the Zscaler Exposure Management remediation agent to prioritize remediation and patching for high-risk exposures across external and internal assets.
7. Alert on enumeration: On partner and employee portals, alert on sequential lookups and unusually high numbers of records accessed per session. Apply rate limits to affected endpoints. Enforce server-side authorization for access to customer records and limit responses to the fields required for the operation.
8. Treat open source pentesting harnesses as hostile code: If your organization uses an open source pentesting harness, isolate it from production, avoid storing production credentials in it, and enforce testing scope through configuration and code rather than prompts alone. Review forks before execution. Use Zscaler’s open source Agentic Radar to map agent workflows from source code.
9. Test authorization regularly: Repeat security testing as applications change, and verify that users cannot access records or functions outside their assigned permissions. 

Threat Details

ARTEX is an agentic penetration testing framework originally released on GitHub by the developer "Autumn-27". It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns.

The threat actor configured ARTEX to use the following AI backends:

Table 1: AI backends configured in ARTEX and their roles in the campaign. 

Following public disclosure of the abuse, the ARTEX developer made the project closed source. However, previously downloaded copies and forks may remain available.

How it Works

The campaign unfolds in four phases from ARTEX-assisted reconnaissance and exploitation to data theft and monetization planning.

1. Reconnaissance: ARTEX agents autonomously identified and probed peripheral internet-facing web applications outside the institutions’ core banking infrastructure, including customer-facing inquiry portals and employee-facing mobile application backends.
2. Exploitation: LLM-driven agents identified and exploited vulnerabilities including SQL injection and authentication bypass in the peripheral web applications to gain unauthorized access.
3. Data exfiltration: Stolen records included full names, phone numbers, annual income figures, and loan limits. This information could support subsequent financial fraud and social engineering.
4. Monetization planning: The threat actor used Claude Code sessions to seek advice on selling stolen South Korean financial PII and to locate Korean-language Telegram channels used to sell stolen data.

Attack chain

The attack chain below illustrates the four phases of the campaign.

Figure 1: ARTEX attack chain, from reconnaissance and exploitation to data exfiltration and monetization planning. 

ARTEX architecture and agent workflow

ARTEX uses an orchestration layer, known as a harness, to coordinate its models and agents. The harness provides the model with the current task state and previous results. The model selects the next action, a worker executes the selected tool against the target, and the results are returned to the model to inform subsequent actions.

The planner divides the engagement into tasks, while worker agents execute tools and store findings, and the reporting component generates a report containing validated findings.

The harness supported multiple LLM backends. In this campaign, the threat actor configured ARTEX to use the services listed in Table 1.

ARTEX guardrails and scope controls

ARTEX included guardrails intended to restrict targeting of government entities and universities through a default blocklist. However, these restrictions did not extend to financial institutions, as shown in ARTEX’s source code below.

Figure 2: ARTEX source code defining default government and education domain filters. 

Behavioral Indicators

The following table outlines potential indicators defenders can investigate alongside other evidence of suspicious activity. 

Table 2: Potential behavioral and file-based indicators associated with the techniques described in this campaign. 

How Zscaler Can Help

Zscaler Coverage

Zscaler’s multilayered cloud security platform detects indicators related to the campaign at various levels with the following threat name:

• HTML.MalURL.Gen.LZ