Single Person's AI Stack Breached 20 Japanese Firms and 7 Korean Banks

A single attacker used a toolchain of AI agents including ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code to breach approximately 20 Japanese companies and seven South Korean banks, according to a report from CrowdStrike. The security firm Ierae found that the server used for the Japanese campaign concentrated its attacks on a single industry, affecting nine of the targeted firms. CrowdStrike tied the operation to a likely Chinese-speaking, financially motivated actor who repurposed the ARTEX tool, originally built for authorized network defense, to conduct cross-border attacks.