ARTEX developer halts public updates after reported misuse in Korean financial hacks
In short
The developer of ARTEX, an AI penetration-testing tool linked in reports to attacks on South Korean financial institutions, said public updates and maintenance would stop and its source code would become private. The original GitHub page has disappeared, but previously distributed copies remain available.
Read the full story 1 min read
The developer of ARTEX, a Chinese AI penetration-testing tool reportedly used in attacks on South Korean financial institutions, has halted its public development. In an October 8 GitHub statement, the developer using the account Autumn-27 said misuse of the tool had led to a decision to stop updates and make its source code private. No additional versions would be released publicly and maintenance support would end. [ 1 , 2 , 3 , 6 ]
The developer said ARTEX was created to help companies and institutions check security risks and improve their defensive capabilities. Newsis reported that the intended use was learning and research on authorised systems. The developer condemned unauthorised or illegal use, said malicious attacks were unrelated to the developer, and disclaimed responsibility for violations of laws and regulations. The statement did not directly refer to the Korean hacking incidents, according to Yonhap and other outlets. [ 2 , 3 , 8 ]
Reuters reported that ARTEX's GitHub page had disappeared. Newsis said accessing the original repository on October 9 produced a 404 error, but other repositories containing earlier source code and a Korean-language version remained public. An information and communications expert in China told AFP that the decision could not remove downloaded copies or stop users from continuing to use them, Yonhap reported. Experts said restricting source access could make it harder for new users to create code. [ 2 , 3 ]
ARTEX connects to external large language models rather than functioning as an independent model, Dong-A Ilbo reported. The program is designed to let AI agents analyse targets, plan penetration routes and run security tools. CrowdStrike said attacks targeting Korean financial institutions occurred from late September to early October and that attackers used ARTEX together with large language models, according to Yonhap and Chosun Ilbo. [ 1 , 3 , 6 ]
Why it matters
Ending public development does not remove copies already downloaded or prevent their continued use, experts told AFP, according to Yonhap. Newsis reported that repositories retaining earlier code, including a Korean-language version, were still public.
Key facts
- Developer Autumn-27 announced on GitHub on October 8 that ARTEX would stop updates and make its source code private. [ 1 , 2 , 3 , 6 ]
- The developer said no further versions or maintenance support would be provided publicly. [ 1 , 2 , 3 , 6 , 8 ]
- The developer said the tool was intended to help companies and institutions assess security risks, and opposed its illegal use. [ 1 , 2 , 8 ]
- Newsis reported that the original repository returned a 404 error on October 9, while other repositories retained existing code. [ 2 ]
- CrowdStrike analysed attacks against Korean financial institutions from late September to early October and said attackers used ARTEX with large language models. [ 3 , 6 ]
- The developer's statement did not directly mention the Korean hacking incidents. [ 1 , 3 , 6 , 8 ]
Confirmed by several sources
- Autumn-27 announced an end to public ARTEX updates and maintenance support. [ 1 , 2 , 3 , 6 , 8 ]
- The original ARTEX GitHub page was no longer accessible. [ 1 , 2 , 3 , 6 , 8 ]
- The developer opposed illegal use of ARTEX and said it was intended for security testing. [ 1 , 2 , 8 ]
- CrowdStrike said ARTEX and large language models were used together in attacks on Korean financial institutions. [ 3 , 6 ]
Still unclear
- The identity of the attacker linked to the Korean financial hacking incidents. Dong-A Ilbo said an identity inferred from AI conversation records was unconfirmed and reported that a Telegram user identified as YY denied involvement.
- How far the withdrawal of public development will limit misuse. Yonhap reported expert assessments that new users may face greater difficulty but downloaded copies cannot be removed; Newsis found earlier code still publicly available.
What local media are saying
Timeline, local time
- Dong-A Ilbo reported on October 9 that the ARTEX developer had announced the halt in public updates on October 8. [ 1 ]
- Newsis reported on October 9 that the original repository returned a 404 error while other repositories retained the code. [ 2 ]
- Yonhap reported on October 10 that downloaded copies could remain in use despite the end of public development. [ 3 ]