ARTEX AI and Claude Agents Weaponized Against South Korean Banks: Detecting AI-Orchestrated Intrusion Tooling in Your Environment

---
title: ARTEX AI Offensive Suite Execution
description: Detects execution of ARTEX AI penetration testing suite components based on binary names, install paths, and module artifacts associated with the framework observed in attacks on South Korean financial institutions.
references:
  - https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
  - https://attack.mitre.org/techniques/T1588.002/
author: Security Arsenal
date: 2026/01/22
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\artex'
      - '\artexai'
  selection_cli:
    CommandLine|contains:
      - 'artex'
      - 'artex_ai'
      - 'artex-agent'
  condition: 1 of selection_*
falsepositives:
  - Authorized red team engagements using the same suite (verify against approved exercise windows)
level: high
---
title: Claude Agent or MCP Tooling on Non-Developer Hosts
description: Detects execution of Claude CLI, Claude Code agents, or Model Context Protocol (MCP) server processes on systems where AI development tooling is not expected, consistent with LLM-agent-driven intrusion activity.
references:
  - https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/22
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'claude mcp'
      - 'claude_code'
      - 'claude-code'
      - 'mcp-server'
      - '@anthropic'
      - 'ANTHROPIC_API_KEY'
  filter_known_dev_hosts:
    Computer|contains:
      - '-DEV-'
      - '-WKS-'
  condition: selection and not filter_known_dev_hosts
falsepositives:
  - Developers running approved AI coding assistants on workstations (scope via asset inventory, not just hostname)
level: high
---
title: LLM API DNS Query from Server Infrastructure
description: Detects DNS resolution of AI model provider API endpoints from systems, a strong signal of agentic LLM tooling executing in-environment when baselined against approved AI integrations.
references:
  - https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/01/22
status: experimental
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
      - 'api.anthropic.com'
      - 'claude.ai'
      - 'api.openai.com'
  condition: selection
falsepositives:
  - Approved enterprise AI integrations (baseline and suppress known-good service accounts/hosts)
  - End-user browsing to claude.ai from workstations (tune to server VLANs for high fidelity)
level: medium

// Hunt 1: LLM API egress from servers (agentic attack tooling callback)
// Scope to server assets; any hit here warrants investigation.
let Lookback = 7d;
let ServerDevices = (DeviceInfo
    | where DeviceType has_any ("Server", "DomainController")
    | summarize by DeviceId, DeviceName);
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any ("api.anthropic.com", "claude.ai", "api.openai.com")
| join kind=inner ServerDevices on DeviceId
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, AccountName
| order by TimeGenerated desc;

// Hunt 2: ARTEX / Claude agent process artifacts across the estate
let Lookback2 = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback2)
| where ProcessCommandLine has_any ("artex", "claude mcp", "claude-code", "mcp-server", "ANTHROPIC_API_KEY")
    or FileName has_any ("artex", "claude.exe", "mcp-server")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

// Hunt 3: Machine-speed execution bursts — many distinct tools spawned in short windows
// AI-driven operators produce tool diversity no human matches. Tune threshold to your baseline.
let Lookback3 = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback3)
| where FileName in~ ("nmap.exe", "masscan.exe", "net.exe", "nltest.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "mimikatz.exe", "rubeus.exe", "psexec.exe", "wmic.exe", "certutil.exe")
| summarize DistinctTools = dcount(FileName), Tools = make_set(FileName), FirstCmd = min(TimeGenerated), LastCmd = max(TimeGenerated) by DeviceName, AccountName, bin(TimeGenerated, 5m)
| where DistinctTools >= 6
| project DeviceName, AccountName, WindowStart = FirstCmd, WindowEnd = LastCmd, DistinctTools, Tools
| order by DistinctTools desc;

-- Hunt for AI offensive tooling artifacts and LLM API connections across the fleet
-- Deploy as a hunt; triage hosts with hits in either section.

// Section 1: Processes and files matching ARTEX / Claude agent indicators
LET proc_hits = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)artex|claude[ -]?(code|mcp)|mcp-server|ANTHROPIC_API_KEY'
   OR Exe =~ '(?i)artex|claude'

LET file_hits = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/.claude*/**', 'C:/ProgramData/*artex*/**', 'C:/*artex*/**', '/tmp/*artex*', '/home/*/.claude*/**'], accessor='auto')

// Section 2: Live network connections to LLM API endpoints (resolved IPs vary; catch process context)
LET net_hits = SELECT Pid, Name, Path, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemotePort = 443
  AND Name =~ '(?i)python|node|claude|artex'

SELECT * FROM proc_hits

# AI-Tooling-Egress-Control.ps1 — Audit and restrict unauthorized AI tooling and LLM API egress
# Run elevated on servers / via GPO or RMM for fleet deployment.
# TEST in a pilot OU before broad enforcement — approved AI integrations will break if not excepted.

$ErrorActionPreference = 'Continue'
$ReportPath = "$env:ProgramData\AIToolingAudit_$(Get-Date -Format yyyyMMdd_HHmmss).log"

# 1. Audit for AI agent tooling artifacts on the host
Write-Output "=== AI Tooling Artifact Audit ===" | Out-File $ReportPath
$suspectPaths = @("$env:USERPROFILE\.claude", "$env:ProgramData\artex", "C:\artex", "$env:TEMP\artex")
foreach ($p in $suspectPaths) {
    if (Test-Path $p) { "FOUND: $p" | Out-File $ReportPath -Append }
}
Get-Process | Where-Object { $_.ProcessName -match 'artex|claude' } |
    Select-Object ProcessName, Id, Path | Out-File $ReportPath -Append

# 2. Check for Anthropic API keys in environment variables (system + user scope)
Write-Output "=== API Key Exposure Check ===" | Out-File $ReportPath -Append
foreach ($scope in 'Machine','User') {
    $key = [Environment]::GetEnvironmentVariable('ANTHROPIC_API_KEY', $scope)
    if ($key) { "WARNING: ANTHROPIC_API_KEY set at $scope scope" | Out-File $ReportPath -Append }
}

# 3. Block egress to LLM API endpoints from this host (remove or scope for approved integrations)
$llmDomains = @('api.anthropic.com', 'claude.ai')
foreach ($d in $llmDomains) {
    $ruleName = "Block-LLM-Egress-$d"
    if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
        $ips = (Resolve-DnsName $d -ErrorAction SilentlyContinue | Where-Object Type -eq 'A').IPAddress
        foreach ($ip in $ips) {
            New-NetFirewallRule -DisplayName "$ruleName-$ip" -Direction Outbound -Action Block `
                -RemoteAddress $ip -RemotePort 443 -Protocol TCP | Out-Null
        }
        "BLOCKED egress: $d" | Out-File $ReportPath -Append
    }
}

# 4. Verify no unexpected listeners spawned by agent tooling
Write-Output "=== Unexpected Listener Check ===" | Out-File $ReportPath -Append
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -notin 135,139,445,3389,5985,5986 } |
    ForEach-Object { $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        "$($_.LocalPort) -> $($proc.ProcessName) ($($proc.Path))" } | Out-File $ReportPath -Append

Write-Output "Audit complete: $ReportPath"