[Exclusive] 50 copies and variants spread despite original being taken offline... Korean version of Chinese AI hacking tool ‘Artex’ emerges

[Financial News] At least 50 copies and derivative variants of ‘Artex (ARTEX),’ a Chinese-made artificial intelligence (AI) penetration tool believed to have been used in hacking attacks against South Korea’s financial sector, have been identified. With five Korean-localized variants also found, concerns are growing that AI-based penetration tools are spreading in various forms even after the original source code was made private.
A review of Financial News’ reporting on the 21st and an analysis by AhnLab’s Security Intelligence Center (ASEC) found that at least 50 Artex copies and derivative variants have been identified so far. As redistribution using the original source code and modifications to its functionality continue, the number of variants could grow further.
Artex is a Chinese-made, AI-based autonomous penetration tool that uses large language models (LLMs) to automate tasks such as vulnerability discovery and penetration testing. It had previously been linked to cyberattacks targeting South Korea’s financial sector. Although the original GitHub repository was subsequently made private, various derivative programs based on code already copied outside the repository continue to circulate.
Five Korean-localized Artex variants have been identified, some with related GitHub repositories that are publicly accessible. Variants localized into various languages, including Chinese, Japanese, Russian and French, as well as Korean, are also circulating. Major derivative programs include ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop and Bob Research Labs. Some of them can reportedly be accessed through ordinary search engines.

According to AhnLab ASEC, Artex variants have gone beyond simply changing the original program’s name or user interface (UI), and appear to add or modify features depending on their purpose. In one derivative program, ‘Bob Research Labs,’ investigators found indications that a remote code execution vulnerability in an e-commerce platform (CVE-2026-75650) had been exploited, as well as malware-related files capable of issuing remote commands to infected systems.
Numerous tools for exploiting web vulnerabilities, including SQL injection and cross-site scripting (XSS), as well as privilege-escalation tools used to obtain administrator privileges and other system permissions, were also found in other public directories. The analysis suggests that Artex operators are modifying the tools by combining the features they need for particular objectives and stages of an attack.
However, no successful attacks or specific cases of damage caused by the variants have been confirmed so far. Some copies and variants were also developed for legitimate security research or penetration testing, so their mere existence does not establish that they are being used maliciously.
Nevertheless, concerns have been raised that the public circulation of programs available in Korean could make them easier for users in South Korea to access and use. Given that the existing source code can be used to modify features or redistribute the tools as new programs, the possibility of malicious use cannot be ruled out.
An AhnLab ASEC representative said, “The original Artex GitHub repository is not publicly accessible at this time, but the code had already been widely copied before the repository disappeared.” The representative added, “Rather than focusing only on whether Artex itself is detected, companies need to review their defenses across the entire attack lifecycle, including initial intrusion, privilege escalation, lateral movement, establishing persistence, and command-and-control (C2) communications. They should operate their security systems comprehensively so they can detect and respond to signs of attack at every stage.”
[email protected] Choi Hye-rim Reporter