IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. First observed in late September 2026, the campaign affected multiple South Korean financial firms and resulted in the exfiltration of personally identifiable information (PII) belonging to approximately 67,000 individuals.ThreatLabz assesses with moderate confidence that the campaign is the work of a financially motivated, Chinese-speaking threat actor. The threat actor exploited peripheral internet-facing web applications, including customer-facing inquiry portals and employee-facing mobile application backends. RecommendationsThe threat actor used AI to support reconnaissance and exploitation in this campaign. ThreatLabz recommends the following practices to strengthen defenses against AI-assisted attacks. For additional context on AI-driven security testing, see our blog: When the Scanner Starts Thinking: Learnings from Mythos & GPT 5.5 Cyber in Security Testing.Reduce application exposure: Reduce your external exposure by moving your applications behind a Zero Trust access solution, like Zscaler Private Access (ZPA). Understand your assets and associated risks: Establish complete visibility into internet-facing and internal assets, including AI assets, and assess their exposure and vulnerabilities to prioritize remediation. Zscaler’s AI Asset Management, Asset Exposure Management, External Attack Surface Management, and Unified Vulnerability can support these efforts.Deploy deception controls: Use Zscaler Deception to detect suspicious reconnaissance and access attempts through decoy assets and accounts. Configure automatic containment to restrict the associated asset or identity’s access to production applications while capturing activity in the decoy environment.Prioritize Zero Trust everywhere architecture: Apply Zero Trust consistently across remote and on-premises environments. Enforce least-privilege user-to-application access to limit lateral propagation and reduce the blast radius from AI-driven attacks.Use AI red teaming and guardrails for your production models: Use AI red teaming and guardrails to assess susceptibility to prompt injection and unsafe outputs. Monitor for hallucinations and model drift over time.Use AI-powered exposure management: Use the Zscaler Exposure Management remediation agent to prioritize remediation and patching for high-risk exposures across external and internal assets.Alert on enumeration: On partner and employee portals, alert on sequential lookups and unusually high numbers of records accessed per session. Apply rate limits to affected endpoints. Enforce server-side authorization for access to customer records and limit responses to the fields required for the operation.Treat open source pentesting harnesses as hostile code: If your organization uses an open source pentesting harness, isolate it from production, avoid storing production credentials in it, and enforce testing scope through configuration and code rather than prompts alone. Review forks before execution. Use Zscaler’s open source Agentic Radar to map agent workflows from source code.Test authorization regularly: Repeat security testing as applications change, and verify that users cannot access records or functions outside their assigned permissions. Threat DetailsARTEX is an agentic penetration testing framework originally released on GitHub by the developer "Autumn-27". It orchestrates multiple LLM backends to autonomously perform reconnaissance, vulnerability identification, and exploitation, significantly lowering the technical barrier for conducting complex intrusion campaigns.The threat actor configured ARTEX to use the following AI backends:BackendRoleDeepSeek v4.1-flashPrimary LLM BackendZhipu AI GLM-5.3Supplementary ReasoningSpaceXAI Grok 4.6Supplementary ReasoningTable 1: AI backends configured in ARTEX and their roles in the campaign. Following public disclosure of the abuse, the ARTEX developer made the project closed source. However, previously downloaded copies and forks may remain available. How it WorksThe campaign unfolds in four phases from ARTEX-assisted reconnaissance and exploitation to data theft and monetization planning.Reconnaissance: ARTEX agents autonomously identified and probed peripheral internet-facing web applications outside the institutions’ core banking infrastructure, including customer-facing inquiry portals and employee-facing mobile application backends.Exploitation: LLM-driven agents identified and exploited vulnerabilities including SQL injection and authentication bypass in the peripheral web applications to gain unauthorized access.Data exfiltration: Stolen records included full names, phone numbers, annual income figures,
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
This article has been indexed from Security Research | Blog
Read the original article: