---
title: Hunt: Hunt.io maps ARTEX jump-host open directories with Claude Code shims, 19 agent skills and JNDI tooling tied to the South Korea bank campaign | ctxsec
url: https://ctxsec.com/items/hunt-artex-huntio-jump-host-claude-code-skills-sk-banks
description: "Hunt.io published a Nov 4 infrastructure deep-dive on the ARTEX campaign CrowdStrike and Genians linked to late-September/early-October breaches at seven South Korean financial institutions (about 66\u201367k people and ~2,200 corporations). Beyond the known console at 38.244.50[.]120, Hunt.io found a Hong Kong jump host at 23.248.226[.]250 with open directories (ports 18099 and 8001) holding credentials, reverse-SSH tunnel scripts, FOFA clients, a staged JNDI/LDAP setup, and Claude Code 2.1.221 state files that route through Claude Code Router and xcai[.]pro shims to DeepSeek (not Anthropic), with GLM/Grok backup paths. Nineteen custom skills totaling 147 uses covered recon, web injection, WAF bypass, payment-logic testing and mobile work. Hunt.io also shows hunting pivots (ARTEX certificate issuer, title match, malware tag) that return hundreds to ~1,300 candidate IPs that still need validation."
status: "vendor research (Hunt.io, Nov 4); expands CrowdStrike/Genians ARTEX reporting on South Korean bank breaches; CERT notified before publish"
published: 2026-11-07
---

> Hunt.io published a Nov 4 infrastructure deep-dive on the ARTEX campaign CrowdStrike and Genians linked to late-September/early-October breaches at seven South Korean financial institutions (about 66–67k people and ~2,200 corporations). Beyond the known console at 38.244.50[.]120, Hunt.io found a Hong Kong jump host at 23.248.226[.]250 with open directories (ports 18099 and 8001) holding credentials, reverse-SSH tunnel scripts, FOFA clients, a staged JNDI/LDAP setup, and Claude Code 2.1.221 state files that route through Claude Code Router and xcai[.]pro shims to DeepSeek (not Anthropic), with GLM/Grok backup paths. Nineteen custom skills totaling 147 uses covered recon, web injection, WAF bypass, payment-logic testing and mobile work. Hunt.io also shows hunting pivots (ARTEX certificate issuer, title match, malware tag) that return hundreds to ~1,300 candidate IPs that still need validation.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-artex-huntio-jump-host-claude-code-skills-sk-banks.md)

vendor research (Hunt.io, Nov 4); expands CrowdStrike/Genians ARTEX reporting on South Korean bank breaches; CERT notified before publish

2026-11-07

### Hunt: Hunt.io maps ARTEX jump-host open directories with Claude Code shims, 19 agent skills and JNDI tooling tied to the South Korea bank campaign

- **Core IOCs:** `38.244.50[.]120` (ARTEX console / SSH tunnel dest; title "ARTEX - 自主渗透测试控制台"; ports 443/8090); `23.248.226[.]250` (HK jump; :18099 open dir, :8001 JNDI/LDAP); `154.201.79[.]246` (proxy enum); domains `xcai[.]pro`, `direct[.]xcai[.]pro`, `fofoapi[.]com`, `u6ud2s[.]dnslog[.]cn`.
- **Cert pivot:** TLS fingerprint associated with issuer org ARTEX on the console host (see Hunt.io IOC table).
- **Host signals:** unexpected Claude Code Router on :3456, Gemini2API admin UIs, Tinyproxy, open dirs with reverse-SSH / skill JSON.
- **Defend:** pull admin panels off the internet (VPN/allowlist); rotate SSH, API, proxy and model-gateway secrets; watch LDAP/JNDI, odd DNS callbacks and model-gateway traffic to unexpected destinations.

Sources: [Hunt.io: ARTEX Exposed — Mapping the Infrastructure Behind the South Korean Bank Breaches (Nov 4)](https://hunt.io/blog/artex-south-korea-bank-infrastructure) · [SecurityAffairs summary of Hunt.io findings (Nov 7)](https://securityaffairs.com/202607/ai/inside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches.html)