By Hamza Faisal
ARTEX, the AI-powered penetration-testing tool linked to a wave of cyberattacks on South Korean banks, is back — this time as a product you can buy.
The open-source version was pulled from GitHub on October 8 after evidence emerged that criminals had used it to breach financial institutions. Barely a week later, Chinese cybersecurity firm ThreatBook has moved to commercialize it: chief executive Xue Feng said on social media on October 16 that "ARTEX is back with a commercial edition."
The commercial version, ARTEX Pro, will live on a new cloud platform called RedAgents.ai, alongside other AI penetration-testing agents named YanJi, YanXun and CyberStrikeAI. According to Xue, the platform runs in a cloud environment that supports Zero Data Retention, meaning session data is not kept after use.
From shutdown to storefront
The pivot is striking. ARTEX began as the personal project of a ThreatBook threat-detection engineer, published on GitHub as a Chinese-language autonomous red-teaming tool — software that chains large language models to scan for vulnerabilities, map attack paths and execute security tooling with minimal human involvement.
From late September into early October, attackers turned it on South Korean financial institutions, slipping through what investigators described as "side doors" in peripheral support systems. As the controversy grew, the developer made the GitHub repository private and declared that ARTEX would no longer be updated.
That shutdown lasted days, not months. Xue confirmed that the same engineer is now leading the commercialization effort — the personal project has effectively become a company product line.
Why banks are alarmed
The alarm in Seoul is easy to understand. ARTEX's power is speed: it can probe systems repeatedly and relentlessly, finding weaknesses that would take human testers far longer to uncover. In the wrong hands, that makes it a weapon — one already proven against real banks.
Security experts say the commercial version changes the risk calculus again. A paid, maintained product on cloud infrastructure is more reliable than a free script on GitHub, and the "Zero Data Retention" promise raises an obvious question: how will the platform verify that a customer buying an AI bank-hacking toolkit actually has permission to test the systems they point it at?
For now, ThreatBook pitches the platform as a tool for legitimate security testing — the same justification as the open-source original. But the timeline tells its own story: pulled as a liability one week, relaunched as a business the next. South Korea's banks, still cleaning up from the first wave, are watching to see what happens when the tool that hit them goes on sale.
By Hamza Faisal
