DeepSeek, a Chinese AI service. Image generated via ChatGPT.
DeepSeek, a Chinese AI service. Image generated via ChatGPT.

ARTEX, a Chinese AI agent suspected of being a key tool in recent cyberattacks on South Korea's financial sector, has been found to be closely integrated with the Chinese AI model DeepSeek.

Security experts say the combination — spanning AI models and autonomous agents — amounts to a "Chinese-made hacking ecosystem," and warn it is emerging as a serious new threat.

According to industry sources, ARTEX's developers added an official web-search feature powered by DeepSeek on Sept. 13.

ARTEX is a Chinese-developed "autonomous AI penetration testing system." Unlike conventional approaches in which a human operator issues commands to probe for security vulnerabilities, ARTEX uses AI to analyze attack targets and distribute tasks across multiple AI agents.

The industry is paying close attention to the addition of DeepSeek's web-search capability. With the feature enabled, ARTEX can use DeepSeek to search for the latest vulnerability data and technical resources needed to carry out attacks.

While ARTEX supports several external AI models including DeepSeek, DeepSeek is currently the only model for which a dedicated web-search integration has been officially added. Analysts say using DeepSeek gives attackers a significant edge, as it allows real-time searches for up-to-date information on top of the model's existing capabilities.

Financial authorities are on high alert after customer data was leaked from major South Korean banks — including Shinhan Bank, KB Kookmin Bank and Hana Bank — in a sweeping series of AI-assisted cyberattacks. [Yonhap]
Financial authorities are on high alert after customer data was leaked from major South Korean banks — including Shinhan Bank, KB Kookmin Bank and Hana Bank — in a sweeping series of AI-assisted cyberattacks. [Yonhap]

However, it has not been confirmed whether DeepSeek was in fact used in the recent attacks on South Korea's financial sector.

"If the attackers used ARTEX, there would have been ample incentive to use not only the DeepSeek model but also its web-search feature whenever they needed to quickly find the latest vulnerabilities or publicly available technical data," an industry official said.

DeepSeek-based models are already prominent within China's AI security agent ecosystem. According to TSecBench, an AI attack-and-defense performance evaluation platform operated by Tencent Security Xuanwu Lab, the top four AI security agents in the current agentic rankings all use DeepSeek Flash as their base model.

Cases of Chinese AI hacking tools built on DeepSeek have also been reported around the world.

Unit 42, the threat intelligence team at Palo Alto Networks, disclosed in July that a Chinese-speaking threat actor had connected DeepSeek to the open-source AI agent Hermes Agent to carry out large-scale attacks. In that campaign, the attacker exploited eight vulnerabilities to target more than 460 internet-connected systems.

Logo of Palo Alto Networks, a US cybersecurity company. [Reuters]
Logo of Palo Alto Networks, a US cybersecurity company. [Reuters]

In that campaign, DeepSeek served as the "brain" of the operation. Hermes Agent provided the operational environment — internet access, command execution and similar functions — while DeepSeek handled vulnerability analysis and target selection.

Unit 42 cited DeepSeek's relatively limited safety guardrails as a key reason the attacker chose it. The attacker had previously tested Western AI models but found them too restrictive for attack tasks due to their safety controls. DeepSeek, by contrast, operates with fewer such constraints, making it easier to pair with attack agents as an offensive tool.

Industry experts agree that the focus should shift beyond individual AI models to the combination of Chinese-made AI models and agents. "This isn't simply a matter of one Chinese AI model being dangerous," one industry official said. "When a model like DeepSeek handles the decision-making and an agent like ARTEX carries out the attack, the entire attack chain becomes automated within the Chinese ecosystem."

Meanwhile, financial authorities confirmed that hacking attempts were detected at a minimum of six banks — Shinhan Bank, Hana Bank, KB Kookmin Bank, Busan Bank, NH NongHyup Bank and Woori Bank — between Wednesday and Saturday. The breaches resulted in the leak of customer data belonging to approximately 25,000 Shinhan Bank customers, 119 at KB Kookmin Bank and 89 at Hana Bank. Authorities said the same IP address was identified across the attacks and that traces of ARTEX were also found originating from that address. The Korean National Police Agency's cyber investigation unit is among the agencies now conducting a probe.


chami@heraldcorp.com