AI Agents Targeted South Korean Banks: What Small Businesses Should Copy From Our Defenses

An attacker used ARTEX and Claude Code sessions in a campaign against South Korean financial organizations, according to CrowdStrike. Small businesses face the same underlying risks: exposed services, powerful credentials and neglected computers. The biggest lesson is to limit what a compromised account or AI agent can reach. This week, inventory your public services, remove private agent files from published content, check endpoint protection and name the person who can stop an incident.

The October 7 CrowdStrike report establishes the campaign's use of AI tooling and evidence of stolen data. It does not establish every bank name, customer count or outage described in subsequent headlines. Those distinctions matter when deciding what to copy into your own operating rules.

We run AI agents for research, code and website work. The practices below generalize the methods in our public operating guides. They are things a business can assign to an employee or service provider, with an observable result. They are not a claim that our environment is immune, or that a checklist substitutes for a security team.

What happened, and what remains uncertain

An AI agent combines a language model with tools and a loop that chooses work, reads results and chooses another action. A chatbot might suggest checking a configuration; an agent with terminal access can perform the check. Agentic AI means this ability to take successive actions toward a goal. The operator's permissions determine how consequential those actions become.

ARTEX is a framework for coordinating agents on penetration testing tasks. A penetration test is an authorized examination of a system's defenses. Using the same software without authorization does not make an intrusion a test. Our companion explanation of ARTEX covers its coordination model at a defensive level.

The timeline

CrowdStrike repeats industry reporting about a loan progress inquiry service used by financial brokers and an employee mobile work support system. These are business applications around banking operations; the report does not justify saying the core banking ledger was taken over. Likewise, reported outages are not proof of a particular destructive technique. Campaign report.

The card-data wording deserves care. Earlier news used the broad phrase credit card information; the later regulator statement specifically distinguished credit card numbers and account passwords. We cannot turn those descriptions into a verified claim that card numbers were stolen. Nor can we assume every reported incident had the same attacker. News account, regulatory update.

Two servers, several models, and exposed working notes

CrowdStrike describes two attacker servers: primary infrastructure in Hong Kong and another server hosting the ARTEX instance likely responsible for the Korean attacks. Its analysis identifies DeepSeek v4.1-flash as ARTEX's primary model backend, supplemented by GLM-5.3 from Zhipu AI and Grok 4.6 in additional Claude Code sessions. These are the report's recorded model names, not models we independently tested. A model backend is the engine answering the agent's requests, like choosing which specialist receives a work order. The agent interface and the engine need not have the same supplier. CrowdStrike.

The attacker left open directories: web locations that exposed files or folder contents to visitors. Researchers found Claude Code session histories, ARTEX settings and Claude memory files. A history records earlier exchanges and actions. Memory files preserve information for later sessions. Configuration files tell software how to operate. Together, they gave investigators a view of the operation that a polished public webpage would not reveal. CrowdStrike.

That mistake is directly relevant to legitimate businesses. Your agent's notes can describe customers, internal systems, unresolved defects and credentials someone pasted months ago. A folder called memory is still a data store. A file called AGENTS.md or CLAUDE.md is still a document that needs a publication decision.

CrowdStrike assessed a likely Chinese-speaking, financially motivated actor with moderate confidence. It did not attribute the campaign to a named adversary. A request for help locating Korean data-sales groups supports an inference about intent; it does not prove a completed sale. We omit the possible personal identity details because the report could not definitively connect them to the operator. CrowdStrike.

Closing the source does not recall copies

The developer's public statement dated October 8 condemns unauthorized misuse and announces closed source and an end to public updates. That is our paraphrase of the Chinese-language statement. BleepingComputer subsequently reports that English and Korean derivatives remained available. Closing a repository cannot recall distributed copies. We did not obtain or run the framework or derivatives. Developer statement, October 10 report.

Defenders should plan around the exposed services and permissions the tools use. Removing one public project cannot repair a vulnerable application, revoke a stolen key or put protection on an overlooked server.

Related campaigns, with separate evidence

CrowdStrike's later VAPOR PANDA report describes a different campaign beginning October 17, targeting more than 200 organizations worldwide. It explicitly separates that operation from Microsoft's Storm-0940 reporting. Its recovered records include an operator directing agents to seek computers lacking endpoint sensors. That is evidence for checking protection coverage everywhere, not evidence that every Korean incident used the same methods. October 29 CrowdStrike report.

Microsoft's Storm-0940 account concerns ARTEX and a ConnectWise Cloud Backup supply chain compromise, involving trusted applications serving multiple customer organizations. A supply chain compromise reaches customers through a trusted supplier. Microsoft cautions that successful application authentication alone does not prove data theft. This is not evidence that every ConnectWise product or customer was compromised. Microsoft.

The broader lesson applies to an MSP, managed service provider, and its RMM, remote monitoring and management tools. These let a provider monitor computers, install updates and administer them remotely. Supplier accounts can carry powerful customer access. Separately, BleepingComputer's October 26 former-pentester report describes another data-theft case using ARTEX, citing local reporting about police findings. We did not independently read a police release and do not identify those suspects with the unnamed bank-campaign actor.

Claude's role and Anthropic's response

The Korean evidence includes Claude Code histories and requests addressed to Claude. It also identifies other companies' model backends. We should preserve both facts rather than describe the entire operation as one model acting independently. Human instructions and infrastructure remained part of the campaign. CrowdStrike.

Anthropic's September 2026 threat report describes disrupting malicious Claude use and improving safeguards. Its reporting period ends in August, before this campaign. We found no campaign-specific Anthropic statement in the material reviewed. The usage-policy page currently displays a revision effective November 12, 2026, after this article's date. That published upcoming revision prohibits unauthorized computer compromise while allowing legally authorized testing; we do not present it as the policy already in force.

The same class of coding agent can review a business's own software. Our Cloudflare security audit skill guide describes source review, contained checks and human verification. A tool's legitimate use does not erase misuse; misuse does not make every defensive use irresponsible. Authority, containment and evidence are the deciding controls.

A campaign diagram and a defender's work order

┌─────────────────────┐
│ Human operator      │
└──────────┬──────────┘
           ▼
AI agents on attacker servers
           ▼
Internet-facing bank services
           ▼
Data leaves affected organizations

Attacker's open directories
           ▼
Histories + settings + memory → Investigation evidence

Defender's work order
Inventory → Close exposure → Patch → EDR everywhere
           ▼
Rotate keys → Watch logs → Incident plan

Our best practices, generalized for your business

These are operating recommendations, not a claim that each control would have stopped every reported intrusion. The connections below identify which observed failure makes each task worth doing. Costs depend on existing contracts and equipment, so we separate staff work from purchases. We quote no unverified product prices.

1. Treat agent state as sensitive business data

Incident connection: the attacker's own open directories exposed agent histories and memory. Apply that lesson to your working files before someone else does.

This week: have your developer identify the web root, the folder your server publishes, and the build output sent to hosting. Compare those with agent working folders. Exclude .claude, private instructions, memory stores, .env settings and .git history from publication. Disabling folder listings alone is insufficient if someone can still request a known filename. Inspect deployment rules as well as the source repository, the versioned record of your code.

A public AGENTS.md can intentionally contain harmless guidance. The test is its contents and purpose, not its filename. Private customer notes, access details and task histories belong elsewhere. Our memory guide also explains why saved memory needs review: malicious text can persist into later tasks.

Owner and cost: developer plus whoever approves publication. Local file checks use existing tools; reviewing history and fixing publication rules takes staff time. The kit's commands list candidate names without printing their contents. A clean filename check cannot establish that a repository contains no secrets.

2. Keep secrets out of prompts, and retire old keys

Incident connection: the later VAPOR PANDA report describes authentication keys in a 2022 mail-server directory export that likely had not been rotated. Old data remained useful because its authority survived. CrowdStrike recommends rotating signing keys, preauthentication keys and service credentials after suspected exposure, including historical backups and exports. CrowdStrike.

This week: list where service credentials live, who owns them and how they are revoked. A secret store supplies credentials to approved processes; it should not copy them into an agent's briefing or chat. Give jobs short-lived, narrowly scoped access where supported. Review old exports, backup access and shared attachments as part of the same inventory.

If exposure is suspected, use a clean administration device and coordinate revocation with incident responders. Replace the credential, update legitimate consumers and invalidate affected sessions where possible. Deleting a public file does not revoke copies already taken. Preserve evidence privately before cleanup, and do not restore exposed keys from an old backup.

Owner and cost: identity administrator and service owners. Existing credential systems may suffice; replacement secret storage or emergency response needs a quote. Our private Git and runner guide explains why workers must not inherit an administrator's entire key collection.

3. Put administration behind identity checks

Incident connection: the Korean campaign targeted business services reachable over the internet; the later campaign crossed exposed applications and administration services. Reduce the unnecessary doors without confusing a public customer service with an admin panel.

This week: inventory every public hostname, application, management interface and responsible person. Ask why each must be public. Put remote administration behind an identity-aware gateway, which checks a person's identity before allowing access, and require multifactor authentication, meaning more than a password. A tunnel carries a connection outward from the protected service; it does not by itself decide who is authorized.

Test that the original server address cannot bypass the gateway. Keep application permissions and an independent recovery route. Our server setup guide and private-access pattern explain these boundaries. Do not copy an entire server architecture merely to protect one bookkeeping portal.

Owner and cost: IT administrator or MSP, with the business owner approving access. Configuration may fit existing subscriptions; identity service licensing and migration labor require a provider quote. The inventory itself can begin in a spreadsheet.

4. Schedule updates, with a review gate for new dependencies

Incident connection: CrowdStrike recommends patching internet-facing appliances and long-lived servers. A second problem is accepting malicious software through an update. A dependency is another software component your application needs; an IOC, indicator of compromise, is a clue such as a known malicious file hash or address.

This week: choose an owner for routine patch review and urgent advisories. Record installed and running versions, backup readiness and a rollback method. Our IOC gate article describes checking candidate packages against known-bad records before installation, reviewing unfamiliar startup behavior and holding ordinary newly released dependencies for review. LiteLLM is a gateway that routes requests to model services, one example of software whose update deserves that scrutiny.

A release hold is a buffer, not a certificate of safety. Give an urgent security fix a documented exception path with testing; do not leave a known exposed vulnerability open merely to satisfy a waiting period. If the advisory check fails, report that failure instead of claiming a clean result. Our safe update procedure checks the service after restart, because changing a file does not prove the running process changed.

Send a short failure alert to the responsible person's phone. Keep prompts, keys and customer data out of the notification. Owner and cost: administrator or developer. Use existing update and alert systems where suitable; budget for review, recovery testing and any additional monitoring service.

5. Reconcile endpoint protection with the actual inventory

Incident connection: VAPOR PANDA's operator sought hosts without the security sensor. EDR, endpoint detection and response, records suspicious computer behavior and helps responders investigate or contain it. A server in a private network can still be reached after another machine is compromised. CrowdStrike.

This week: compare the asset list with the EDR console. Include servers, remote staff devices and machines maintained by contractors. Check that sensors are healthy, reporting recently and assigned a response owner. Investigate gaps instead of treating the number of purchased licenses as coverage. Where a device cannot run EDR, document compensating restrictions and a replacement plan.

Owner and cost: MSP or security administrator. Ask for a written quote covering endpoints, servers and response hours. A license without anyone reading alerts leaves a different gap. Do not assume the vendor named in a threat report is the only suitable product.

6. Check cloud and identity controls with the specialist

Incident connection: the later campaign combined weak identity validation and cloud access, and reached powerful directory credentials. CrowdStrike's recommendations include SAML signature validation, IMDSv2 and narrower cloud permissions. VAPOR PANDA report.

SAML carries a sign-in assertion from an identity provider to an application, much like a signed visitor pass. Signature validation checks that a trusted issuer signed the pass and that the application accepts it under the right conditions. XXE, XML external entity processing, is a flaw that can make a document reader access resources it should not. The report describes these weaknesses together; your developer should inspect identity validation and parser configuration without recreating the attack.

The Instance Metadata Service gives a cloud machine information about itself and, where configured, temporary credentials. IMDSv2 is AWS's version requiring a session token. Require it where applicable and verify compatibility before changes. It is one protection, not a substitute for reducing a cloud role's permissions. A role is a job badge granting specific cloud actions.

Active Directory is Microsoft's directory for managing organizational identities and computers. LAPS, Local Administrator Password Solution, manages distinct local administrator passwords for devices. Restrict who can retrieve those passwords; deploying LAPS while leaving broad read access defeats much of its purpose. AWS metadata guidance, Microsoft LAPS overview.

This week, owner and cost: the cloud and identity administrators record the current settings, overbroad roles and remediation owners. These are configuration reviews, with labor and compatibility testing as the immediate costs. Where you lack that expertise, buy a scoped review rather than asking a general-purpose agent to alter production identity settings.

7. Include the MSP in your access review

Incident connection: Microsoft's Storm-0940 account shows the risk of trusted supplier applications. Apply that access review to the MSP's RMM tools too.

This week: ask which RMM tools the MSP installs, which accounts can administer your devices, how multifactor authentication works and who can approve scripts across customers. Ask how a supplier compromise reaches you, where independent logs are retained and how you revoke access during an incident. Get named contacts for evenings and weekends. The kit supplies a question sheet you can attach to the contract review.

Owner and cost: business owner and MSP account lead. Asking questions costs staff time; stronger controls or response coverage may change the contract. Request evidence from the actual service you buy, rather than accepting a vendor's general security brochure.

8. Contain your own agents and keep production approval human

Incident connection: recovered histories show how persistent agents, tools and human direction worked together. Those capabilities can also amplify an employee's mistake or a malicious instruction in a document.

This week: run agent jobs on a separate, restricted machine or properly isolated virtual machine. Give each job its own files, written brief, allowed targets, budget and forbidden actions. A branch in a repository separates edits; it does not prevent the process from reading other folders. Keep production credentials out of the environment and enforce network and file boundaries outside the prompt.

Tool calls are requests to software capabilities, such as reading a file. MCP, Model Context Protocol, is a standard way to connect some of those tools. Review the actual enabled capabilities. An instruction to behave safely cannot neutralize a tool with unrestricted administrator access.

Require a human to approve anything touching production. Preserve private progress logs and a stop procedure; keep important logs beyond the agent's ability to erase them. Never direct an agent at systems you do not own without written permission covering the exact work. Our workstation practices, operations kit and Git server kit provide adaptable patterns.

Owner and cost: developer or administrator, with a business reviewer. Isolation may use existing capacity or require a separate machine. Add model usage, logging and review time to the budget before approving the job.

9. Watch your public footprint and prepare the first call

Incident connection: exposed files and services were central to the evidence, while reported outages remind us that response is also a business continuity problem.

This week: schedule passive checks of your own published pages, certificate status and security headers. TLS protects the connection to a site; headers are instructions a server sends browsers. Our Mega Security Analyzer guide introduces checks that can support this review. A clean public-page result does not inspect your private network or prove no breach occurred. File-exposure checks need explicit owner approval and a bounded scope.

Review access and authentication logs for unexpected activity. A vendor IOC match is an investigation lead; shared infrastructure can produce innocent matches, and no match does not establish safety. Maintain private backups and rehearse restoration without reconnecting compromised systems.

Owner and cost: website maintainer plus the person on call. Existing tools can support the first pass; retention, response and recovery require staff time and possibly paid services. Save your insurer's incident number, lawyer's contact and responder's emergency line somewhere accessible when business email is unavailable. The kit adds current FBI IC3 and CISA reporting routes.

The Computer Fraud and Abuse Act and other legal risks

Pointing agentic penetration testing tools at someone else's systems can cross into unauthorized access under 18 U.S.C. § 1030. Public visibility is not permission to break in. Get authorization in writing from an owner with authority over the precise systems, methods and dates. Our rule is passive public monitoring only; active testing is a separate engagement with written scope. Use the authorization kit.

The DOJ's 2022 good-faith research policy guides federal charging decisions. It is not permission from a system owner or immunity from civil claims and state law. California Penal Code § 502 and Texas Penal Code § 33.02 create separate computer-access risks.

Customer-data exposure also raises notification duties. The FTC Safeguards Rule, 16 C.F.R. part 314, covers certain nonbank financial businesses, including some small firms. Its notification amendment took effect in May 2024. A qualifying event involving unauthorized acquisition of at least 500 consumers' unencrypted information requires notice to the FTC as soon as possible and no later than 30 days after discovery; an exposed encryption key can matter too. Have counsel apply the definitions and timing. States have their own duties, and reporting to the FTC does not replace them. FTC guidance.

Today's code audit, reverse engineering, web data permissions, Firecrawl and AI video guides expand the access, contractual, privacy and reuse questions. A model's willingness to help settles none of them.

Download the readiness kit

• AI agent attack readiness kit (.md): a one-page checklist, staff and contractor operating rules, tested local file checks, key rotation runbook, MSP questions, first-hour contact card and defanged indicators for searching your own logs.

For a small service business deciding what it can responsibly promise clients, The $20 Dollar Agency is a useful companion. Put the review time, access limits and response responsibility in the offer before taking the work.

Related reading

• How ARTEX works, explained for defenders
• Cloudflare's security audit skill
• rea and reverse engineering boundaries
• Scrapling and web data permissions
• Firecrawl for small business web data
• MoneyPrinterTurbo and AI video responsibilities
• GitHub's top repos for small businesses
• The update gate we added after the LiteLLM incident

Fact-check notes and sources

Read dates below are November 3, 2026, UTC. Times describe source review, not incident times. Direct reads were supplemented by home-browser excerpts where needed. No attack software was obtained or executed, no indicator address was contacted, and no paid product prices are quoted. Proposed work schedules are our recommendations.

• Korean campaign: CrowdStrike, October 7, read 22:31:33: campaign window, two servers, model names, exposed state, attribution limits and indicators. Application descriptions in that report are attributed to industry reporting.
• Regulator: FSC, October 14, read 22:31:31: broader breach count, data estimate, limits on password and card-number reports, and continuing investigation. Its count is not a confirmed total for one actor.
• Separate operations: CrowdStrike, October 29, read 22:32:21: VAPOR PANDA, old exports, cloud and identity weaknesses, endpoint coverage and recommendations. Microsoft, October 21, read 22:31:31: Storm-0940 and Cloud Backup application trust, with authentication versus theft caveat.
• Provider and developer: Anthropic threat report, read 22:31:31; upcoming usage policy, 22:32:09; developer statement, 22:31:31. No verified Anthropic statement about this particular campaign was found.
• Configuration references: AWS IMDS and Microsoft LAPS, read 22:31:13: token-based metadata access and managed local administrator passwords.
• Law: 18 U.S.C. § 1030 and Texas chapter 33, read 22:31:33. DOJ charging policy and California § 502: home-browser excerpts recorded before 21:39. FTC Safeguards guidance: home-browser excerpts recorded before 22:33. Exact individual browser read times were not supplied.
• Reporting: Kyunghyang Shinmun, read 22:31:31, is labeled an AI-translated English report. BleepingComputer, October 5, read 22:31:31; October 10, supplied home-browser excerpts recorded between 22:25 and 22:30; October 26, read 22:32:09. News claims retain their attribution.
• Our methods: the linked memory, server, workstation, private Git, IOC gate, update and security-audit guides and their kits were reviewed from publication source at 22:37:31. They describe operating methods, not independent evidence about the Korean incidents. File-check commands were tested on synthetic local fixtures; the kit records their limits.

This post is informational, not legal or security advice for your specific systems. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.