International
The Morning Dev

Only the news worth knowing

‹
 
B50/100

Breach · high

ARTEX-linked campaign: backdoored CWP server images and AI hacking tools tied to South Korean bank breaches

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Seven South Korean financial institutions and exposed ARTEX and CWP servers

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Remote, no login · Full takeover · Secrets exposed

What to do

  1. Check internet-facing ARTEX servers and restrict their public exposure
  2. Review Control Web Panel installations for the backdoor described by XLab
  3. Consult the indicators of compromise and hunting queries in Microsoft's ARTEX guidance

The Brief

  • Microsoft says financially motivated actor Storm-3358 began targeting financial sector organizations in October 2026 using an agentic AI offensive tool called ARTEX.
  • Hunt.io traced ARTEX servers and AI-powered hacking tools to breaches of seven South Korean financial institutions between late September and early October 2026.
  • XLab researchers found a Linux backdoor hidden in the web server of Control Web Panel (CWP), which executes commands sent via web requests without logs.

Why it matters

Developers and sysadmins running CWP hosting servers or internet-exposed ARTEX instances may already be compromised, and the campaign shows that exposed AI hacking tooling is being used against real financial targets.

The checklist behind the tier

Checklist · 5 of 10 yes
YesHits tech teamsCWP is a panel for managing Linux hosting servers, used by sysadmins and ops teams.
NoCore infrastructureCWP is a single control panel product, not foundational software nearly every team runs.
NoPopular toolCWP and ARTEX are niche products rather than mainstream developer tech used by many teams.
YesExploited in the wildMicrosoft Security Blog: Storm-3358 targeted financial sector organizations using ARTEX in October 2026.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept was published.
YesRemote, no loginTechCrunch: hundreds of exposed Artex servers allow anyone access to the hacking tool.
YesFull takeoverThe Hacker News: the CWP backdoor executes commands attackers send via web requests, enabling code execution.
YesSecrets exposedSecurity Affairs: data breached at seven South Korean financial institutions via internet-facing systems, about 66,000 affected.
NoSupply chainSources describe a backdoor in the CWP server but do not say an official package or build pipeline was compromised.
NoNo fix yetNone of the sources state whether a patched version of CWP or ARTEX is available.

Timeline

  1. The Hacker News

    CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

  2. BleepingComputer

    Hackers backdoor Linux servers using trojanized CWP web server

  3. XLab reports a backdoor hidden in the Control Web Panel web server

  4. Researchers report hundreds of ARTEX hacking tool servers exposed to the internet

  5. Microsoft reports ARTEX abuse expanding to the financial sector

  6. The Hacker News

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

  7. AI News & Artificial Intelligence | TechCrunch

    Hundreds of Artex AI hacking tools found publicly exposed to the web

  8. Hunt.io traces ARTEX servers and tools to breaches at seven South Korean financial institutions

  9. Microsoft Security Blog

    ARTEX abuse expands as cybercriminals target financial sector

  10. Security Affairs

    Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches

Full coverage · 6 sources

First seen · 6 sources · Full story page · How tiers are decided