INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Open Source Security Tool Compromised via Unpatched Vulnerability in GitHub

| 2026-10-02 11:20 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A recent data breach incident at Shinhan Bank, where approximately 25,000 people's information was leaked due to a bypass of the authentication procedure for its loan recruitment service, has raised concerns about the misuse of publicly available security tools. The attack is believed to have been carried out by an unauthorized external user who exploited vulnerabilities in Fortinet devices via network weaknesses, potentially using AI-based open-source tools such as ARTEX AI and Strix Strike. This incident highlights the need for caution when utilizing publicly available security tools amid suspicions that standard penetration testing tools may be being used to automate and increase the efficiency of cyber attacks. The attack cycle involved surveillance, vulnerability scanning, penetration, and information theft, showcasing the potential risks associated with open-source hacking.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Credential Stuffing): Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance
Incident Timeline
‎September 10 to 15
Threat actors used the penetration test tool Strix and autonomous AI agent Hermes to conduct 105 attacks against more than 27 companies from September 10 to 15.
general_metric 146 times
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
infrastructure 138 hosts
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
general_metric 105 attacks
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
general_metric 27 companies
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
‎2026/10/02
A Chinese-linked attacker used the open-source security tool ARTEX AI to target multiple systems, including Fortinet devices and online services.
organisation Fortinet
Team Cymru, a US-based threat intelligence company, has raised the possibility that this tool could be exploited by nation-state actors to carry out attacks on Fortinet devices via network vulnerabilities.
organisation Hestra Strike
In May, the Google Threat Intelligence Group (GTIG) has identified a pattern of activity suggesting a Chinese-linked attacker targeting a Japanese technology company and an East Asian cyber security platform, using both Hestra Strike and Strikex together.
organisation Shinhan Bank
"Attacked 'Open Source Security Tool'···Urgent: Open Source Security Issue". Shinhan Bank has raised concerns that the 'ARTEX AI' open-source security tool may have been used in the recent data breach incident, prompting the need for alternative measures to prevent the misuse of publicly available security tools.
organisation ARTEX
Recently, credential stuffing incidents have occurred in the domestic financial sector, with the possibility of ARTEX AI being used also being raised.
organisation LLM
ARTEX AI is an open-source, LLM-based autonomous penetration testing system that was publicly released on GitHub.
organisation ARTEX AI
The official GitHub page of ARTEX AI explicitly states that it should not be used for scanning, exploring, or attacking websites, online services, or internet-connected systems.
organisation Juniper Security Center
According to Jun Hyun, the CEO of Juniper Security Center, "The fact that AI tools that can be used by anyone may have been used in the attack has led to a more common era of hacking.
organisation Androptic
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation GLM
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation DeepSight
Hermes used the Androptic's Claude Offer 4.6, while Strix and Cairn used the GLM and DeepSight models.
organisation HexStrike AI
Additionally, HexStrike AI stated on its official GitHub that it is a security tool developed for autonomous execution of more than 150 security tools by its AI agent, and that it is only intended for use on approved systems.
organisation CyberStrike AI
The AI-based open-source security tool CyberStrike AI integrates over one hundred security tools, automating vulnerability discovery, attack chain analysis, and exploitation.
Tactical Metrics
Metrics
infrastructure
138
Hosts
The attackers conducted a penetration test tool called Strix from August 23 to 31, executing it in deep mode 146 times and scanning 138 hosts, and from September 10 to 15, they used the penetration test engine Cairn and autonomous AI agent Hermes to conduct 105 attacks, causing damage to more than 27 companies.
Intelligence Sources
Datanet 2026-10-02