Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions Rohit Hegde (Sr. Staff Threat Researcher)

IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. First observed in late September 2026, the campaign affected multiple South Korean financial firms and resulted in the exfiltration of personally identifiable information (PII) belonging to approximately 67,000 individuals.ThreatLabz assesses with moderate confidence that the campaign is the work of a financially motivated, Chinese-speaking threat actor. The threat actor exploited peripheral internet-facing web applications, including customer-facing inquiry portals and employee-facing mobile application backends. RecommendationsThe threat actor used AI to support reconnaissance and exploitation in this campaign. ThreatLabz recommends the following practices to strengthen defenses against AI-assisted attacks. For additional context on AI-driven security testing, see our blog: When the Scanner Starts Thinking: Learnings from Mythos & GPT 5.5 Cyber in Security Testing.Reduce application exposure: Reduce your external exposure by moving your applications behind a Zero Trust access solution, like Zscaler Private Access (ZPA). Understand your assets and associated risks: Establish complete visibility into internet-facing and internal assets, including AI assets, and assess their exposure and vulnerabilities to prioritize remediation. Zscaler’s AI Asset Management, Asset Exposure Management, External Attack Surface Management, and Unified Vulnerability can support these efforts.Deploy deception controls: Use Zscaler Deception to detect suspicious reconnaissance and access attempts through decoy assets and accounts. Configure automatic containment to restrict the associated asset or identity’s access to production applications while capturing activity in the decoy environment.Prioritize Zero Trust everywhere architecture: Apply Zero Trust consistently across remote and on-premises environments. Enforce least-privilege user-to-application access to limit lateral propagation and reduce the blast radius from AI-driven attacks.Use AI red teaming and guardrails for your production models: Use AI red teaming and guardrails to assess susceptibility to prompt injection and unsafe outputs. Monitor for hallucinations and model drift over time.Use AI-powered exposure management: Use the Zscaler Exposure Management remediation agent to prioritize remediation and patching for high-risk exposures across external and internal assets.Alert on enumeration: On partner and employee portals, alert on sequential lookups and unusually high numbers of records accessed per session. Apply rate limits to affected endpoints. Enforce server-side authorization for access to customer records and limit responses to the fields required for the operation.Treat open source pentesting harnesses as hostile code: If your organization uses an open source pentesting harness, isolate it from production, avoid storing production credentials in it, and enforce testing scope through configuration and code rather than prompts alone. Review forks before execution. Use Zscaler’s open source Agentic Radar to map agent workflows from source code.Test authorization regularly: Repeat security testing as applications change, and verify that users cannot access records or functions outside their assigned permissions.  Threat DetailsARTEX is an agentic penetration testing framework originally released on GitHub by the developer “Autumn-27”. It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns.The threat actor configured ARTEX to use the following AI backends:BackendRoleDeepSeek v4.1-flashPrimary LLM BackendZhipu AI GLM-5.3Supplementary ReasoningSpaceXAI Grok 4.6Supplementary ReasoningTable 1: AI backends configured in ARTEX and their roles in the campaign. Following public disclosure of the abuse, the ARTEX developer made the project closed source. However, previously downloaded copies and forks may remain available. How it WorksThe campaign unfolds in four phases from ARTEX-assisted reconnaissance and exploitation to data theft and monetization planning.Reconnaissance: ARTEX agents autonomously identified and probed peripheral internet-facing web applications outside the institutions’ core banking infrastructure, including customer-facing inquiry portals and employee-facing mobile application backends.Exploitation: LLM-driven agents identified and exploited vulnerabilities including SQL injection and authentication bypass in the peripheral web applications to gain unauthorized access.Data exfiltration: Stolen records included full names, phone numbers, annual income figures, and loan limits. This information could support subsequent financial fraud and social engineering.Monetization planning: The threat actor used Claude Code sessions to seek advice on selling stolen South Korean financial PII and to locate Korean-language Telegram channels used to sell stolen data.Attack chainThe attack chain below illustrates the four phases of the campaign.Figure 1: ARTEX attack chain, from reconnaissance and exploitation to data exfiltration and monetization planning. ARTEX architecture and agent workflowARTEX uses an orchestration layer, known as a harness, to coordinate its models and agents. The harness provides the model with the current task state and previous results. The model selects the next action, a worker executes the selected tool against the target, and the results are returned to the model to inform subsequent actions.The planner divides the engagement into tasks, while worker agents execute tools and store findings, and the reporting component generates a report containing validated findings.The harness supported multiple LLM backends. In this campaign, the threat actor configured ARTEX to use the services listed in Table 1.ARTEX guardrails and scope controlsARTEX included guardrails intended to restrict targeting of government entities and universities through a default blocklist. However, these restrictions did not extend to financial institutions, as shown in ARTEX’s source code below.Figure 2: ARTEX source code defining default government and education domain filters.  Behavioral IndicatorsThe following table outlines potential indicators defenders can investigate alongside other evidence of suspicious activity. IndicatorDescriptionOutbound API calls to api.anthropic.com, api.deepseek.com, open.bigmodel.cn, or api.x.aiPotential use of LLM services; investigate unexpected calls in conjunction with other suspicious activityHigh-frequency automated HTTP requests with sequential enumeration patterns against login and search endpointsPotential automated reconnaissance or enumerationOutbound transfers of structured data including names, phone numbers, and financial information over HTTPS to unauthorized external destinationsPotential exfiltration of financial PIIPresence of *.aspx or *.jsp files in unexpected web application pathsPotential web shell activityTable 2: Potential behavioral and file-based indicators associated with the techniques described in this campaign.  How Zscaler Can HelpStageRecommended MitigationMinimize the external attack surfaceEliminate externally exposed assets like enterprise applications which are often subject to these zero-day exploitation attempts by leveraging a Zero Trust architecture.Perform red teaming on all external assets. Zscaler’s AI red teaming uses an agentic workflow with controls designed to support authorized security testing:Start with the application’s source code to map the agent’s tools, permissions, inputs, and access checks. Our agents then test specific security hypotheses.Update the testing plan after each finding. Each agent has a defined role and access only to that role’s tools. Shared memory tracks roles, trust boundaries, and data flows. This supports testing whether a user, such as a broker, can access another broker’s client files.Enforce rules of engagement in the harness rather than relying on model instructions alone.Prevent compromiseDetonate unknown second-stage payloads with Advanced Cloud Sandbox.Route server egress through ZIA to detect/block post-compromise activity.Enable SSL/TLS inspection for all traffic, including trusted sources.Enable Advanced Threat Protection to block known C2 domains.Use Advanced Cloud Firewall to extend C2 controls across all ports/protocols, including emerging C2.Prevent lateral threat movementUse ZPA to enforce least-privilege user-to-app segmentation for crown-jewel apps (employees and third parties).Use ZPA inline inspection to block exploitation attempts against private apps from compromised users.Use Zscaler Deception to detect and contain lateral movement or privilege escalation with decoy assets and accounts.Prevent data lossInspect outbound traffic across channels with Zscaler DLP. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to the campaign at various levels with the following threat name:HTML.MalURL.Gen.LZ  

​[#item_full_content] IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. First observed in late September 2026, the campaign affected multiple South Korean financial firms and resulted in the exfiltration of personally identifiable information (PII) belonging to approximately 67,000 individuals.ThreatLabz assesses with moderate confidence that the campaign is the work of a financially motivated, Chinese-speaking threat actor. The threat actor exploited peripheral internet-facing web applications, including customer-facing inquiry portals and employee-facing mobile application backends. RecommendationsThe threat actor used AI to support reconnaissance and exploitation in this campaign. ThreatLabz recommends the following practices to strengthen defenses against AI-assisted attacks. For additional context on AI-driven security testing, see our blog: When the Scanner Starts Thinking: Learnings from Mythos & GPT 5.5 Cyber in Security Testing.Reduce application exposure: Reduce your external exposure by moving your applications behind a Zero Trust access solution, like Zscaler Private Access (ZPA). Understand your assets and associated risks: Establish complete visibility into internet-facing and internal assets, including AI assets, and assess their exposure and vulnerabilities to prioritize remediation. Zscaler’s AI Asset Management, Asset Exposure Management, External Attack Surface Management, and Unified Vulnerability can support these efforts.Deploy deception controls: Use Zscaler Deception to detect suspicious reconnaissance and access attempts through decoy assets and accounts. Configure automatic containment to restrict the associated asset or identity’s access to production applications while capturing activity in the decoy environment.Prioritize Zero Trust everywhere architecture: Apply Zero Trust consistently across remote and on-premises environments. Enforce least-privilege user-to-application access to limit lateral propagation and reduce the blast radius from AI-driven attacks.Use AI red teaming and guardrails for your production models: Use AI red teaming and guardrails to assess susceptibility to prompt injection and unsafe outputs. Monitor for hallucinations and model drift over time.Use AI-powered exposure management: Use the Zscaler Exposure Management remediation agent to prioritize remediation and patching for high-risk exposures across external and internal assets.Alert on enumeration: On partner and employee portals, alert on sequential lookups and unusually high numbers of records accessed per session. Apply rate limits to affected endpoints. Enforce server-side authorization for access to customer records and limit responses to the fields required for the operation.Treat open source pentesting harnesses as hostile code: If your organization uses an open source pentesting harness, isolate it from production, avoid storing production credentials in it, and enforce testing scope through configuration and code rather than prompts alone. Review forks before execution. Use Zscaler’s open source Agentic Radar to map agent workflows from source code.Test authorization regularly: Repeat security testing as applications change, and verify that users cannot access records or functions outside their assigned permissions.  Threat DetailsARTEX is an agentic penetration testing framework originally released on GitHub by the developer “Autumn-27”. It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns.The threat actor configured ARTEX to use the following AI backends:BackendRoleDeepSeek v4.1-flashPrimary LLM BackendZhipu AI GLM-5.3Supplementary ReasoningSpaceXAI Grok 4.6Supplementary ReasoningTable 1: AI backends configured in ARTEX and their roles in the campaign. Following public disclosure of the abuse, the ARTEX developer made the project closed source. However, previously downloaded copies and forks may remain available. How it WorksThe campaign unfolds in four phases from ARTEX-assisted reconnaissance and exploitation to data theft and monetization planning.Reconnaissance: ARTEX agents autonomously identified and probed peripheral internet-facing web applications outside the institutions’ core banking infrastructure, including customer-facing inquiry portals and employee-facing mobile application backends.Exploitation: LLM-driven agents identified and exploited vulnerabilities including SQL injection and authentication bypass in the peripheral web applications to gain unauthorized access.Data exfiltration: Stolen records included full names, phone numbers, annual income figures, and loan limits. This information could support subsequent financial fraud and social engineering.Monetization planning: The threat actor used Claude Code sessions to seek advice on selling stolen South Korean financial PII and to locate Korean-language Telegram channels used to sell stolen data.Attack chainThe attack chain below illustrates the four phases of the campaign.Figure 1: ARTEX attack chain, from reconnaissance and exploitation to data exfiltration and monetization planning. ARTEX architecture and agent workflowARTEX uses an orchestration layer, known as a harness, to coordinate its models and agents. The harness provides the model with the current task state and previous results. The model selects the next action, a worker executes the selected tool against the target, and the results are returned to the model to inform subsequent actions.The planner divides the engagement into tasks, while worker agents execute tools and store findings, and the reporting component generates a report containing validated findings.The harness supported multiple LLM backends. In this campaign, the threat actor configured ARTEX to use the services listed in Table 1.ARTEX guardrails and scope controlsARTEX included guardrails intended to restrict targeting of government entities and universities through a default blocklist. However, these restrictions did not extend to financial institutions, as shown in ARTEX’s source code below.Figure 2: ARTEX source code defining default government and education domain filters.  Behavioral IndicatorsThe following table outlines potential indicators defenders can investigate alongside other evidence of suspicious activity. IndicatorDescriptionOutbound API calls to api.anthropic.com, api.deepseek.com, open.bigmodel.cn, or api.x.aiPotential use of LLM services; investigate unexpected calls in conjunction with other suspicious activityHigh-frequency automated HTTP requests with sequential enumeration patterns against login and search endpointsPotential automated reconnaissance or enumerationOutbound transfers of structured data including names, phone numbers, and financial information over HTTPS to unauthorized external destinationsPotential exfiltration of financial PIIPresence of *.aspx or *.jsp files in unexpected web application pathsPotential web shell activityTable 2: Potential behavioral and file-based indicators associated with the techniques described in this campaign.  How Zscaler Can HelpStageRecommended MitigationMinimize the external attack surfaceEliminate externally exposed assets like enterprise applications which are often subject to these zero-day exploitation attempts by leveraging a Zero Trust architecture.Perform red teaming on all external assets. Zscaler’s AI red teaming uses an agentic workflow with controls designed to support authorized security testing:Start with the application’s source code to map the agent’s tools, permissions, inputs, and access checks. Our agents then test specific security hypotheses.Update the testing plan after each finding. Each agent has a defined role and access only to that role’s tools. Shared memory tracks roles, trust boundaries, and data flows. This supports testing whether a user, such as a broker, can access another broker’s client files.Enforce rules of engagement in the harness rather than relying on model instructions alone.Prevent compromiseDetonate unknown second-stage payloads with Advanced Cloud Sandbox.Route server egress through ZIA to detect/block post-compromise activity.Enable SSL/TLS inspection for all traffic, including trusted sources.Enable Advanced Threat Protection to block known C2 domains.Use Advanced Cloud Firewall to extend C2 controls across all ports/protocols, including emerging C2.Prevent lateral threat movementUse ZPA to enforce least-privilege user-to-app segmentation for crown-jewel apps (employees and third parties).Use ZPA inline inspection to block exploitation attempts against private apps from compromised users.Use Zscaler Deception to detect and contain lateral movement or privilege escalation with decoy assets and accounts.Prevent data lossInspect outbound traffic across channels with Zscaler DLP. Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to the campaign at various levels with the following threat name:HTML.MalURL.Gen.LZ