Taiwan Information Security Association
Join TWISA
Menu

AI RiskThu, 22 Oct 2026

④ ARTEX: When attackers use agents to probe services and move inside a network

Evidence from attacks on financial organizations and a separate lab exercise shows how agent tooling can accelerate reconnaissance and execution.

Download PDF (Traditional Chinese)View applicable solutionsBack to AI risk insights
01

Article

CrowdStrike reported on October 7 that attacks against South Korean financial organizations in late September and early October led to data exfiltration. It obtained ARTEX configuration files, Claude Code activity and memory files from an attacker-controlled directory. The main model backend for that ARTEX instance was DeepSeek v4.1-flash. Separate Claude Code sessions used GLM-5.3 and Grok 4.6.

On October 12, AhnLab reported finding web shell, internal reconnaissance, credential collection and remote control artifacts, with some execution traces. Its October 14 controlled exercise separately showed how ARTEX tested file-upload weaknesses or known ActiveMQ vulnerabilities and used tool output to choose subsequent actions.

Attack flowHow the attack progressed
  1. 01

    Probe reachable services

    The controlled exercise mapped web functions and backend services.

  2. 02

    Exploit an entry point

    The team separately tested file upload and known ActiveMQ vulnerabilities.

  3. 03

    Move inward

    The agent used tool results to probe the internal network and run additional commands in the lab.

What to do: from the perimeter to internal systems

Response flowResponse steps
  1. 01

    Find exposed services

    Inventory public, internal, outsourced and standby services. Patch reachable components first.

    See what to doResources: 1

    TWISA member solutions

    Find exposed services

    Inventory public, internal, outsourced and standby services. Patch reachable components first.

  2. 02

    Test the paths

    With authorization, test web uploads, APIs, messaging services and segmentation independently.

    See what to doResources: 1

    TWISA member solutions

    Test the paths

    With authorization, test web uploads, APIs, messaging services and segmentation independently.

  3. 03

    Trace process activity

    Correlate web service child processes, files and outbound connections to identify unexpected execution.

    See what to doResources: 1

    TWISA member solutions

    Trace process activity

    Correlate web service child processes, files and outbound connections to identify unexpected execution.

  4. 04

    Investigate and recover

    Preserve host and network records and review credentials, lateral movement and potential data access before recovery.

    See what to doResources: 1

    TWISA member solutions

    Investigate and recover

    Preserve host and network records and review credentials, lateral movement and potential data access before recovery.

Defense architectureLayered defense

Public services, hosts, operational credentials and internal data

Allow authorized traffic and apply controls at each layer.

  1. 01

    Find exposed services

    Public services, hosts, operational credentials and internal data

    Validate the controlInventory public, internal, outsourced and standby services. Patch reachable components first.

  2. 02

    Test the paths

    Public services, hosts, operational credentials and internal data

    Validate the controlWith authorization, test web uploads, APIs, messaging services and segmentation independently.

  3. 03

    Trace process activity

    Public services, hosts, operational credentials and internal data

    Validate the controlCorrelate web service child processes, files and outbound connections to identify unexpected execution.

Feed logs and traffic data from each layer into monitoring and response.

  1. Investigate and recoverPreserve host and network records and review credentials, lateral movement and potential data access before recovery.

TWISA member solutions

Continue the discussion at CIX

A future CIX discussion can use one reachable service as a starting point for threat modeling. Bring a map of what an attacker could reach next and compare independent controls across web services, hosts and network segments.

Sources and further reading

Column updated: 2026/10/25.