TAG-217 is Recorded Future Insikt Group's designation for the actor linked to AI-assisted attacks on South Korean financial institutions in late September and early October 2026. Insikt describes it as opportunistic, combining AI services with established techniques. CrowdStrike published what appears to be the same activity on October 7, 2026 as an unattributed 'unknown threat actor' and assessed, with moderate confidence, that the operator is likely a Chinese speaker and financially motivated. That the two reports cover one actor is our reading: Recorded Future does not name CrowdStrike or state it.

CrowdStrike describes ARTEX as a recently released open-source agentic penetration testing tool developed in China, used with large language models. Such tools are built to help authorised red teams, but this campaign shows an attacker running one against real targets.

How many victims were there?

Counts are still moving. Early press reporting (The Record, October 6, citing the Wall Street Journal) said at least 68,000 people were reportedly exposed across at least seven institutions. On October 14, 2026, South Korea's Financial Services Commission said 16 financial firms were affected and about 100,000 records exposed, a tally that could rise, per the Korea Times. The exposed data included names, contact details and resident registration numbers; regulators found no evidence so far that account or card numbers were compromised. The FSC was still investigating whether one group was behind all the attacks. CrowdStrike says the number of affected organisations is unconfirmed.

Is this attributed to a nation-state?

No. Recorded Future says the actor is suspected to be a Chinese speaker, drawing on public analysis, and CrowdStrike assesses with moderate confidence that the operator is likely a Chinese speaker and financially motivated. Neither report names a government sponsor. In our view, language alone is weak evidence of nationality or backing.

TAG-217: Inside the ARTEX-Powered…

An unattributed operator ran an open-source agentic penetration testing framework, backed by commercial language models, against South Korean financial organisations in late September and early October 2026. Then they left their working directories open on the internet. Reports from CrowdStrike (October 7) and Recorded Future’s Insikt Group, which tracks the actor as TAG-217, use those exposed files to reconstruct what the operator built, what they tried, and how little of it was subtle.

CrowdStrike does not use the TAG-217 name, and Recorded Future does not name CrowdStrike; it says only that public analysis identified the AI tools involved, and it links the CrowdStrike post. We treat the two as covering one actor on that basis. That is our reading, not a statement either vendor makes.

What Happened

The breaches first came to light on September 30, 2026, according to The Record (October 6), which reported that officials believed the Chinese tool Artex AI was used. According to CrowdStrike, the actor reportedly breached a loan progress inquiry service used by financial brokers at one bank, and an employee mobile work-support system at another, and exfiltrated data.

The victim count has grown. The Record, citing the Wall Street Journal, reported on October 6 that at least 68,000 people were “reportedly” exposed across at least seven institutions. On October 14, South Korea’s Financial Services Commission said the number of affected firms had risen to 16, with about 100,000 records exposed, a tally that could still rise (Korea Times). Names, contact details and resident registration numbers were exposed; regulators had found no evidence so far of account or card numbers being compromised. The FSC was still investigating whether the attacks came from one hacking group. The Korea Times report does not mention ARTEX, and CrowdStrike says the number of affected organisations is unconfirmed. These are press and regulator figures as of October 14, not numbers from either vendor’s analysis.

The Tooling: ARTEX Plus Commercial LLMs

CrowdStrike calls ARTEX “a recently released open-source agentic penetration testing (pentesting) tool developed in China,” used alongside large language models. Its report lists the model backends it found:

DeepSeek v4.1-flash as the primary ARTEX backend, likely reached through an API proxy or reseller at xcai[.]pro.
GLM-5.3 (Zhipu AI) and Grok 4.6 in additional Claude Code sessions.

The October 7 public analysis that Recorded Future cites also lists Claude Code among the tools. The exposed /.claude/CLAUDE.md file on the ARTEX host held a Chinese-language pentesting prompt instructing the model how to conduct testing.

The architecture was two servers. One is a Hong Kong-based IP serving as primary attacker infrastructure, whose address CrowdStrike does not publish. The other is 38.244.50[.]120, hosting the ARTEX instance likely used in the Korean attacks. Both exposed open directories.

What the Exposed Directories Showed

Recorded Future reconstructed the timeline from those directories:

August 17–22, 2026: testing remote-access infrastructure and scanning the internet. Logs show connections between the actor’s own servers, with no confirmed victim access.
By August 22: tooling aimed at YiiMP cryptocurrency mining operations, able to try default passwords, steal wallet configuration and key files, keep remote access, and send Telegram alerts when credentials were captured. Other tools targeted known Linux weaknesses.
By September 5: a workspace for testing iPhone weaknesses and modifying Android system software. Recorded Future says logs show testing, not a successful compromise.
By September 26: records of reconnaissance, proxy routing, payload delivery and payment-process checks, plus residential-proxy routing and AI memory files copied between the actor’s servers.

CrowdStrike also reports sessions where the actor asked Claude where threat actors typically sell Korean breach data and how to find Korean Telegram data-sale groups, and a session doing vulnerability research on a Telegram-based NFT gift marketplace. It listed these MITRE ATT&CK techniques: T1583.003 (virtual private servers), T1588.007 (obtaining AI capabilities) and T1090 (proxy).

Attribution and Limits

CrowdStrike assesses with moderate confidence that the actor is likely a Chinese speaker and financially motivated, based on the Chinese-developed tool and Chinese-language prompts. Recorded Future says the actor is suspected to be a Chinese speaker, attributing that to public analysis. Neither report names a sponsor. Our own view is that a tool’s language and a prompt’s language are weak evidence of nationality or backing.

The reports are also careful about what the evidence does not show. Recorded Future says: “The available evidence does not establish the extent to which AI accelerated these attacks.” Its logs for the August infrastructure tests “did not indicate successful access to victim systems,” and the mobile testing “did not demonstrate successful compromise.” The toolkit shows the range of environments explored, not confirmed success against all of them.

Indicators

CrowdStrike publishes ten IP indicators, all defanged in its report. These include 38.244.50[.]120 and nine proxy IPs used during the activity, plus the reseller domain xcai[.]pro. Recorded Future’s public post does not publish IPs, domains or file hashes. Treat the proxy IPs with care: shared proxy services can carry legitimate traffic.

Defensive Guidance

Recorded Future’s recommendations are practical and not specific to ARTEX:

Close gaps around sensitive data: inventory internet-accessible services, confirm users can access only the records they are authorised to see, prioritise by exposure, and log and monitor those services.
Feed continuously updated threat intelligence into monitoring and response so alerts are enriched and historical searches triggered.
Correlate attacker infrastructure with internal signals such as unusual sign-ins, repeated record requests, unexpected remote access and abnormal data transfers.
Preauthorise proportionate automated responses for well-understood threats, and require human review where evidence is uncertain or blocking shared proxy addresses could disrupt legitimate customers.

CrowdStrike’s report contains no detection or mitigation advice of its own.

What This Means

Neither report shows a novel capability. The operator used an existing open-source tool, off-the-shelf models and reseller access, and still reached at least several institutions in a few weeks, while leaving the evidence in open directories. Recorded Future judges it “highly likely” that more actors will adopt ARTEX and similar tools. For defenders, the weak points the actor probed were ordinary: broker and employee-facing applications with record-level access controls. The AI element changes the speed and breadth of probing, not the controls that stop it.

TAG-217: Inside the ARTEX-Powered Campaign Against South Korean Banks