Reposted by Harold S
Mamdani: There is no explanation for these tactics. There is no explanation for federal officers firing this many rounds into a car that has a five year old in the car. Look at how many people live right here. This is a residential neighborhood. We are right here by a subway.
![Andrew Curran @AndrewCurran_
X.com
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source Al penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
The Claude Code sessions reveal a two-server architecture: The Hong Kong-based IP address serves as the primary attacker-controlled infrastructure, and the IP address 38. 244.50 [• ]120 hosts the ARTEX instance likely responsible for the described Korean attacks. The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM-5.3 (Zhipu Al) and Grok 4.6 for additional Claude Code sessions. The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[• ]pro.
3:14 AM • 10/8/26 • 563K Views](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:gvda6fem6r7selm4gzjjww4a/bafkreic2ecy4knref6xt6tfc27brgigk6e4pj7lx6vnmeduhh23dnkjnum)
