CrowdStrike published an October 7, 2026 investigation into an unknown threat actor using ARTEX and model-assisted tooling against South Korean financial organizations. It describes activity from late September through early October. October 10 reporting does not make the original investigation a new same-day disclosure.
The security company says attacker-controlled open directories contained Claude Code session histories, ARTEX configuration files and Claude memory files. Those records provide evidence about tooling and activity. The report also relies on industry accounts for details of financial-sector breaches.
CrowdStrike says the ARTEX instance used DeepSeek v4.1-flash as its main model backend, with GLM-5.3 and Grok 4.6 used for additional Claude Code sessions. A session tool name and the model serving that session are different facts; the records should not be simplified into a claim that one model alone caused every intrusion.
The report says targets in the recovered sessions overlap with organizations identified in industry reporting. It expressly states that the number of affected organizations remains unconfirmed. The source does not provide a verified total of affected customers, stolen records or financial losses.
CrowdStrike assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated. A resume-generation prompt contained personal details, but the report says available information cannot definitively associate those details with the actor. This brief therefore does not publish them as a confirmed identity.
Limits: this is a security-vendor investigation, not a court finding or an independently reproduced attribution. Recovered model sessions show how AI tools were involved in the activity, but do not establish that the tools created every vulnerability or that every reported outage had the same cause. Attribution, incident scope and responsibility remain separate questions.