The developer of an open-source AI penetration-testing tool used in a series of cyberattacks on Korean financial institutions has announced an end to public updates and distribution, citing misuse of the software.
Artex, developed in China and first unveiled in July, was intended to help companies assess their security weaknesses but was used by an attacker to hack Korean financial institutions, according to a Financial Security Institute official quoted by the Herald Business.
The developer, who goes by "Autumn-27" on the code-hosting platform GitHub, said in a post on Thursday that the tool would become a closed-source project, with no further public releases or maintenance support, citing “misuse of the tool.”
The statement did not directly address the attacks on Korean financial institutions. Reuters reported that Artex’s GitHub page had been taken down.
U.S. cybersecurity company CrowdStrike said Wednesday that the attacks involved Artex and Anthropic's Claude Code.
At least nine Korean financial institutions have reportedly experienced or been targeted by cyberattacks since late September, according to Reuters. Police have opened an investigation, and President Lee Jae Myung has called for a strong response.
Automatic teller machines for various banks are installed in Seoul on Oct. 6.NEWS1
Asked about the case at a regular briefing Thursday, Chinese foreign ministry spokesperson Mao Ning said she was unfamiliar with it and that Beijing consistently opposed and cracked down on hacking.
The decision to halt public development is unlikely to prevent continued use of Artex. Previously released source code and downloaded copies can remain in use regardless of whether the developer provides further updates.
The case has also drawn attention to the risks of AI-assisted cyberattacks. CrowdStrike said the attacker had used AI tools to carry out effective attacks despite having relatively limited technical skills.
Adam Meyers, a CrowdStrike senior vice president, told Reuters that the attacker’s capabilities were not particularly sophisticated but had nonetheless proved effective.
In the meantime, Korea's Financial Supervisory Service and the police opened an investigation earlier this week.
The suspected hacker may be a member of a Chinese DDoS-for-hire group, according to a Korean cybersecurity firm.
In a follow-up analysis of the Artex campaign released on Friday, security platform Logpresso said it had found evidence suggesting that the suspect previously identified by CrowdStrike had been active in the Chinese DDoS-for-hire group called GodNet/Vitas.
The U.S. cybersecurity firm said the suspect was likely a 26-year-old man living in China’s Guangdong Province, though the man reportedly denied involvement, claiming his identity had been stolen.
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
