Recorded Future Ties TAG-217 to ARTEX Attacks on South Korean Banks, While Zscaler Maps LLM Backends and AhnLab Shows Forks Plus Detectable User-Agents Across Hundreds of Exposed Instances

AUSTIN - Recorded Future's Insikt Group said on Oct. 16, 2026 that the financially motivated actor it tracks as TAG-217 was already testing remote-access infrastructure, crypto-mining theft tools and mobile exploit workspaces weeks before South Korean financial regulators disclosed a wave of bank breaches tied to ARTEX, a Chinese-language open-source agentic penetration testing framework. Zscaler ThreatLabz, AhnLab ASEC and CrowdStrike Intelligence published overlapping analyses of the same campaign between Oct. 7 and Oct. 16, turning a regional incident into a concrete SOC problem: an LLM-orchestrated harness that can discover and exploit peripheral web apps, leave detectable User-Agents, and is now being forked and rebranded across hundreds of internet-exposed instances.

South Korea's Financial Services Commission disclosed the bank incidents in early October. The Herald Business, citing the Korea Financial Security Institute, reported that investigators tracing attack IPs and logs from Shinhan Bank confirmed ARTEX was used, that every confirmed breach hit employee or partner-facing systems rather than core internet banking, and that Shinhan alone said 25,729 people's data was exposed through a loan-agent inquiry service, with smaller counts at KB Kookmin Bank (119), Hana Bank (89) and BNK Busan Bank (11). Recorded Future said subsequent public reporting put personal data for at least 68,000 people across at least seven financial institutions in play; Zscaler put the figure at about 67,000. An institute official told The Herald Business the AI did not act alone: a human operator used the tool.

ARTEX, originally released on GitHub by a developer credited as Autumn-27, is an agentic harness that wires large language models to reconnaissance, vulnerability checks and exploitation. Zscaler said the operators in this campaign configured DeepSeek v4.1-flash as the primary backend, with Zhipu AI's GLM-5.3 and SpaceXAI's Grok 4.6 for supplementary sessions, and that after the abuse became public the original project was made closed source, though forks remain. CrowdStrike Intelligence said open directories on threat actor infrastructure exposed Claude Code session histories, ARTEX configuration files and Claude memory files, Chinese-language pentesting prompts, and a two-server layout with an ARTEX instance at 38.244.50[.]120 and a Hong Kong host as the primary attacker-controlled node. Both CrowdStrike and Zscaler said the operator also asked Claude where Korean breach data is typically sold and for help finding Korean-language Telegram sales channels. CrowdStrike assessed with moderate confidence that the actor is a Chinese speaker and financially motivated; Zscaler reached the same assessment with moderate confidence.

Recorded Future's timeline, built from open directories TAG-217 left exposed, pushes the start of preparations into mid-August. Between Aug. 17 and Aug. 22, Insikt said, the actor tested remote-access infrastructure and internet scanning, with logs showing repeated test connections between its own servers rather than successful victim access. By Aug. 22 it had assembled tools aimed at YiiMP crypto-mining platforms, including default-password sprays, wallet configuration and key theft, remote access and Telegram alerts on captured credentials, plus Linux privilege and password-extraction helpers. By Sept. 5 it had a workspace for testing iPhone weaknesses and modifying Android system software, again without evidence of successful compromise in the recovered logs. By Sept. 26 its working environment held AI tools and records referencing reconnaissance, traffic proxying, payload delivery and payment-process examination, along with helpers that routed traffic through residential internet connections, maintained links between servers and copied AI working-memory files between TAG-217 hosts. Insikt framed the pattern as the "jagged edge" of AI-enabled attacks: broader, faster probing across environments alongside basic operational-security mistakes that let defenders reconstruct the operator's prep work.

Zscaler described a four-phase chain on the bank side: ARTEX agents probing peripheral customer inquiry portals and employee mobile backends; LLM-driven exploitation including SQL injection and authentication bypass; exfiltration of names, phone numbers, annual income figures and loan limits; and monetization planning through Claude Code. The firm's source-code review showed ARTEX shipped default intercept rules that blocked targeting of .gov and .edu domains, including Chinese equivalents, but did not extend that blocklist to financial institutions. For SOC teams, Zscaler published behavioral hooks that do not depend on a single IP: unexpected outbound calls to LLM APIs such as api.anthropic.com, api.deepseek.com, open.bigmodel.cn or api.x.ai alongside other suspicious activity; high-frequency sequential enumeration against login and search endpoints; outbound transfers of structured financial PII; and unexpected .aspx or .jsp files in web paths.

AhnLab ASEC's Oct. 13 analysis, updated Oct. 15, is the strongest detection-engineering piece of the package. Using the ARTEX web console as a tracking key, ASEC said it identified 600 public IP addresses hosting ARTEX instances, with 541 (90.2%) in the United States, China, Hong Kong and Singapore, and that by Oct. 14 the count of publicly reachable ARTEX-associated addresses was about 900. On some of those hosts ASEC recovered two open directories totaling 51 files tied to internal reconnaissance, pivoting and follow-on payloads, including a script that sent commands to an ASPX web shell, a PowerShell pivot that relayed external connections to internal RDP, JVM heap-dump credential extractors and a Linux implant loader. ASEC published two IP addresses and 18 MD5 hashes from those directories. In controlled tests where operators gave ARTEX only a target, objective and scope, ASEC said the tool uploaded a web shell and ran the Windows Calculator on a file-upload vulnerable host, and in a separate ActiveMQ 5.15.15 lab built around CVE-2023-46604 it reached remote command execution on four internal hosts after initial access to a boundary server. ASEC warned that User-Agent strings alone are not a silver bullet, but its PoC still left concrete fingerprints: artex-selfupdate on GitHub update checks, norma/0.4 on Web Fetch to the target, and curl on file uploads, with nmap, nxc and Impacket appearing in recon stages that may not leave HTTP User-Agents at all.

ASEC's Oct. 14 follow-up on ARTEX infrastructure #4 shows why the story still matters after the original GitHub repo disappeared. Independent redistributions kept ARTEX's multi-agent orchestration while renaming the product as ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop and Bob Research Labs, among others. In the Bob Research Labs environment ASEC said it found a reaper-full build that still restored Planner and Worker state from PostgreSQL, LLM profiles for DeepSeek, GLM, Kimi and Claude, and a working copy of StyleSmuggler, a public proof of concept for CVE-2026-75650, an unauthenticated Magento/Adobe Commerce remote code execution flaw, plus IRC bot deployment artifacts. The takeaway for defensive teams is that ARTEX is no longer a single project to block by name; it is a family of forks whose common behaviors, LLM API egress, sequential portal enumeration and the published User-Agents, are more durable than any one binary.

For SOC and detection teams, the combined research points to a short list of hunts rather than a single signature. Alert on unexpected LLM API egress from servers that also show high-volume sequential lookups against partner or employee portals. Correlate those sessions with new web shells, Impacket or xfreerdp activity and residential-proxy egress. Treat open-source pentest harnesses as hostile code: isolate them from production credentials and enforce scope in configuration, not in prompts. Inventory internet-accessible employee and partner apps with the same seriousness as customer banking front ends, which is where Korean investigators said every confirmed breach landed. And watch for the fork names and ARTEX path strings ASEC recovered, because the original Autumn-27 project going closed source did not retire the technique.