Reposted by Carol Capper
Carol Capper
@cjcapper.bsky.social
325 followers 174 following 943 posts
Poet, Yoga Therapist, Retired Occupational Therapist, Knitter, Lover of Democracy (and not necessarily in that order)
Poet, Yoga Therapist, Retired Occupational Therapist, Knitter, Lover of Democracy (and not necessarily in that order)
![Andrew Curran @AndrewCurran_
X.com
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source Al penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
The Claude Code sessions reveal a two-server architecture: The Hong Kong-based IP address serves as the primary attacker-controlled infrastructure, and the IP address 38. 244.50 [• ]120 hosts the ARTEX instance likely responsible for the described Korean attacks. The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu Al) and Grok 4.6 for additional Claude Code sessions. The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[• ]pro.
3:14 AM • 10/8/26 • 563K Views](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:gvda6fem6r7selm4gzjjww4a/bafkreic2ecy4knref6xt6tfc27brgigk6e4pj7lx6vnmeduhh23dnkjnum)
