一人、一款AI渗透工具连黑多家韩国银行：CrowdStrike揭露中国开源工具ARTEX遭滥用，作者急停项目
美国网络安全公司 CrowdStrike 于 10 月 7 日发布情报报告，揭露一起发生在 9 月底至 10 月初、针对韩国多家金融机构的系列入侵行动：一名疑似单独作案的攻击者，利用中国开源的 AI 渗透测试工具 ARTEX，配合多个商用大语言模型，接连攻破了至少九家韩国银行和金融机构，窃取大量客户数据。报告称，这起案件表明，AI 工具已把过去需要一个团队才能完成的复杂攻击，压缩成一个人加一台机器就能完成的任务。
CrowdStrike 的调查始于攻击者自己服务器上敞开的目录。调查人员发现，两台攻击者控制的服务器——一台位于香港的骨干服务器和一台运行 ARTEX 实例的机器——目录对外开放，里面留着 Anthropic 编程助手 Claude Code 的完整会话记录、ARTEX 配置文件和 Claude 记忆文件。日志显示，攻击者用中文下达指令，曾让 Claude 帮忙起草一份安全研究员简历（上面列着一所中国大学、广东某地、一个 Telegram 用户名和 26 岁的年龄），还询问 Claude 韩国数据泄露信息通常在哪些 Telegram 群组出售。这些线索成为归因依据，但 CrowdStrike 强调，目前并未把攻击者归到任何已知黑客组织名下，仅以中等置信度评估其为“疑似中文使用者、出于牟利动机”。
在被攻破的机构中，新韩银行（Shinhan Bank）损失最重：据韩国《京乡新闻》报道，仅该行就有超过 2.5 万条客户记录被盗，包含姓名、联系方式、收入和授信额度等。攻击者还打进了金融机构经纪人使用的贷款进度查询服务和员工手机办公支持系统。韩国警方已对系列案件展开全面调查，金融监管部门召开紧急会议，总统李在明要求彻查。CrowdStrike 在报告中引用攻击者的原话——“ARTEX 项目将不再更新并转为闭源，今后不会再发布任何版本或提供维护支持”——这是工具开发者 Autumn-27 在 10 月 8 日 GitHub 上的回应，他坚称 ARTEX“最初是为学习和研究目的设计”，攻击“与开发者无关”。
值得注意的是，这起案件把几家 AI 大厂都卷了进来：ARTEX 主要调用的是 DeepSeek v4.1-flash，另有一些会话调用了智谱的 GLM-5.3 和 xAI 的 Grok 4.6，DeepSeek 的访问据称经由一家 API 中转商 xcai.pro 实现。路透社在 10 月 8 日跟进了这份报告。与此同时，Anthropic 自家也在处理 AI 失控问题——该公司本周承认内部测试的智能体曾擅自提交美国签证申请、向费城警方递送虚假谋杀线报，并已切断内部评估与互联网的连接。AI 既是攻击者的武器，也成了防御者必须盯防的变量，这场攻防正在同时升级。
专家指出，这类“智能体化渗透工具”最大的危险在于降低了攻击门槛：它能像受雇的安全测试员一样，自主规划、一步步探测网络弱点，而操作者只需看懂提示词。此前日本软银和大和证券也在同一周披露了数据泄露事件。CrowdStrike 警告，随着开源 AI 渗透框架扩散，“攻击者人数”的假设必须重写——企业的安全基线，得按“对手只有一个人，但机器永不疲倦”来设计。
One Person, One AI Pentest Tool, Multiple Korean Banks Breached: CrowdStrike Exposes Abuse of Chinese Open-Source Tool ARTEX as Author Pulls the Plug
U.S. cybersecurity firm CrowdStrike published an intelligence report on October 7 exposing a late-September to early-October campaign against South Korean financial institutions: a suspected lone attacker used ARTEX, a Chinese open-source AI penetration-testing tool, together with several commercial large language models, to breach at least nine South Korean banks and financial firms and exfiltrate large volumes of customer data. The case, CrowdStrike said, shows AI tools have compressed attacks that once required a whole team into jobs one person plus one machine can carry out.
The investigation began in the attacker's own open directories. Investigators found two attacker-controlled servers — a Hong Kong-based backbone server and a machine running an ARTEX instance — with folders left open to the internet, containing full Claude Code session histories from Anthropic's coding assistant, ARTEX configuration files and Claude memory files. The logs show the attacker issuing instructions in Chinese, once asking Claude to draft a security-researcher resume (listing a Chinese university, a location in Guangdong province, a Telegram username and age 26), and asking where stolen Korean data-breach information is typically sold. CrowdStrike stressed it has not attributed the activity to any known group, assessing with moderate confidence only that the actor is "likely a Chinese speaker and financially motivated."
Shinhan Bank was hit hardest: South Korea's Khan newspaper reported more than 25,000 customer records stolen from that bank alone, including names, contact details, income and credit limits. The intrusions hit loan-progress inquiry services used by brokers and employee mobile work-support systems. South Korean police have opened a full-scale investigation, the financial regulator held an emergency meeting, and President Lee Jae Myung ordered a thorough probe. In response, ARTEX developer Autumn-27 wrote on GitHub on October 8 that "the ARTEX project will no longer be updated and will be converted to closed source," insisting ARTEX was "originally designed for the purpose of learning and research" and the attacks had nothing to do with the developer.
The case has drawn several AI labs into the spotlight: ARTEX ran primarily on DeepSeek v4.1-flash, with other sessions calling Zhipu AI's GLM-5.3 and xAI's Grok 4.6, with DeepSeek access reportedly routed through an API reseller, xcai.pro. Reuters followed up on the report on October 8. Meanwhile Anthropic is dealing with its own runaway-AI problem — the company admitted this week that internal test agents autonomously submitted U.S. visa applications and filed a false murder tip with Philadelphia police, and has since cut live internet access for all internal evaluations. AI is now both the attacker's weapon and a variable defenders must watch, and both sides of the contest are escalating at once.
Experts say the real danger of "agentic" pentest tools is the lowered bar: they probe networks step by step like hired security testers, while the operator only needs to understand prompts. Japan's SoftBank and Daiwa Securities disclosed data breaches in the same week. CrowdStrike warned that as open-source AI pentest frameworks spread, the old assumption about attacker headcount must be rewritten — corporate security baselines should be designed for an adversary who is just one person, but whose machine never sleeps.
图片来源：图：美军网络作战演练现场，人员在电脑终端前作业。美国空军官方照片，摄影：Shelton Keel，公有领域，来源：Wikimedia Commons
