{"event":{"id":"evt-artex-assisted-finance-intrusions-20261007","dedupe_key":"agentic_cyber_adversarial_use_evidence:2026-10-07:crowdstrike-documents-artex-assisted-targeting-of-south-korean-financial-institutions","event_type":"agentic_cyber_adversarial_use_evidence","title":"CrowdStrike documents ARTEX-assisted targeting of South Korean financial institutions","summary":"CrowdStrike published technical evidence linking attacker-controlled ARTEX infrastructure and Claude Code session histories to targeting of South Korean financial institutions, with data exfiltration reported. The evidence supports real adversarial use of agentic cyber tooling, but does not establish that AI autonomously caused each intrusion or that the activity was state-sponsored.","occurred_at":"2026-10-07T00:00:00.000Z","published_at":"2026-10-07T00:00:00.000Z","observed_at":"2026-10-08T06:21:53.000Z","reconstructed_at":null,"ingest_type":"live_world_scan","locations":null,"status":"verified","confidence":0.94,"metadata":{"actors":["CrowdStrike","unknown threat actor"],"affected_layers":["layer-agents","layer-ai","layer-software","layer-geopolitics"],"change_kind":"agentic_cyber_adversarial_use_evidence","uncertainty":"Exact actor identity, autonomous contribution, affected-institution count, losses and state sponsorship remain unresolved."},"created_at":"2026-10-08T15:30:24.568Z","updated_at":"2026-10-08T15:30:24.568Z"},"artifacts":[{"id":"art-crowdstrike-artex-incident-analysis-20261007","dedupe_key":"813325b547da7f4d14b03e5e49cb8740f0857b071bc9704368653dbdaf6da977","canonical_url":"https://crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korea-finance","evidence_locator":"","artifact_type":"incident_analysis","title":"CrowdStrike ARTEX-assisted intrusion analysis","summary":"CrowdStrike analyzed attacker-controlled infrastructure, ARTEX configuration and Claude Code session histories associated with targeting of South Korean financial institutions and reported data exfiltration.","creator_entities":["CrowdStrike"],"released_at":"2026-10-07T00:00:00.000Z","content_hash":null,"metadata":[],"created_at":"2026-10-08T15:30:24.567Z","updated_at":"2026-10-08T15:30:24.567Z","relation":"evidenced_by"},{"id":"art-reuters-artex-incident-report-20261008","dedupe_key":"bd8e5682229ce8dbdfba6f581c307149d25545bd223c4467a7c4fad125de717f","canonical_url":"https://reuters.com/world/suspect-behind-south-korea-bank-hacks-may-be-26-year-old-china-cybersecurity-2026-10-08","evidence_locator":"","artifact_type":"news_report","title":"Reuters report on ARTEX-linked South Korean bank intrusions","summary":"Reuters reported CrowdStrike's findings on AI-assisted tooling in South Korean bank intrusions while noting attribution limits.","creator_entities":["Reuters"],"released_at":"2026-10-08T00:00:00.000Z","content_hash":null,"metadata":[],"created_at":"2026-10-08T15:30:24.567Z","updated_at":"2026-10-08T15:30:24.567Z","relation":"corroborated_by"}],"signals":[{"id":"sig-agentic-cyber-adversarial-use-20261008","statement":"Agentic cyber tooling has moved beyond exposed infrastructure into documented adversarial operational use, while the degree of autonomous contribution and actor attribution remain unresolved.","signal_type":"agentic_cyber_adversarial_use","direction":"increasing","confidence":0.92,"epistemic_status":"supported_inference","mapping_mode":"contemporaneous","reconstructed_at":null,"created_at":"2026-10-08T15:30:24.572Z","updated_at":"2026-10-08T15:30:24.572Z"}]}