ARTEX attacks: security checks for UAE businesses

What CrowdStrike found about ARTEX attacks

CrowdStrike says an unknown, financially motivated threat actor used ARTEX, an open-source agentic penetration-testing tool developed in China, alongside large language models in a campaign against South Korean financial organisations. The activity ran from late September to early October 2026 and resulted in data exfiltration. The actor has not been named, although CrowdStrike assessed with moderate confidence that the operator was likely Chinese-speaking. Read the CrowdStrike ARTEX report for the technical account.

ARTEX is important because it can help automate parts of offensive security work. CrowdStrike found Claude Code session histories, ARTEX configuration files and memory files in open directories controlled by the actor. The reported setup used one server as the main attacker-controlled system and another to host ARTEX. The ARTEX instance used DeepSeek v4.1-flash as its main model, with other models used in additional sessions.

The important change is not that malware has become magical. It is that parts of attack work can now be repeated and scaled with less manual effort.

UAE business security checks after ARTEX attacks

There is no claim in the report that UAE organisations were targeted. The sensible conclusion is narrower: any UAE company with internet-facing applications, cloud accounts, online payments or valuable customer data should assume that attackers may use more automation when looking for weak points.

That matters particularly for businesses where one compromised account can reach several systems. A finance employee may have access to payment tools, shared drives and customer records. A developer account may reach a live application. A supplier login may be connected to an ecommerce or accounting workflow.

The first question is not whether to buy an AI security product. It is whether the business can answer four basic questions:

If the answers are unclear, the weakness is governance as much as technology. A new detection tool will not repair unknown systems, shared passwords or permissions that were never reviewed.

• —Which systems are exposed to the internet
• —Which users and suppliers can reach them
• —Where administrator access is used
• —Which logs would show an unusual login or data transfer

How UAE businesses can review systems, access and logs

Start with an inventory of the public-facing parts of the business. Include the website, customer portal, payment integrations, cloud storage, remote access tools and any mobile or web application. Record the owner of each system, the supplier responsible for it and the people who can administer it.

Then check access. Turn on multi-factor authentication wherever the service supports it. Remove former staff and unused supplier accounts. Replace shared administrator credentials with named accounts. Give each user only the access needed for their job, and review privileged access on a regular schedule.

Next, check whether important events are recorded. At minimum, the business should be able to investigate unusual sign-ins, changes to administrator settings, new API keys, bulk downloads and unexpected transfers of customer or financial data. Logs are useful only if someone knows where they are and who reviews them.

For a business running several disconnected tools, this review can expose a process problem. Paknology’s ERP and automation service brings CRM, sales, inventory, accounting reports and workflow automation into a connected system with shared roles and reporting. That can reduce scattered access, but it is not a replacement for endpoint protection, penetration testing or incident response.

UAE retailer example: reviewing systems, access and logs

Consider a UAE retailer whose website, payment gateway, accounting system and cloud storage were set up by different suppliers. The owner does not need to rebuild everything because ARTEX was used in South Korea. A proportionate response would be to list every administrator, confirm multi-factor authentication, remove dormant accounts, rotate old API keys, and ask each supplier where security logs can be retrieved.

If the retailer cannot identify who can access customer exports or payment-related settings, that is the first problem to solve. If the systems are already documented and access is controlled, the sensible response may be no new purchase at all. The owner should keep the inventory, schedule a review and ask the relevant IT or security provider whether current monitoring covers the applications in use.

Paknology services for UAE business systems—and their limits

Paknology has a commercial interest where the review shows that a website, portal or connected business system needs building or restructuring. Its websites and mobile apps service covers websites, ecommerce platforms, mobile apps, portals and API integrations. It does not provide cybersecurity monitoring, malware removal or incident response.

A cheaper or simpler option may be better if the business already has a capable IT provider. A password review, account clean-up and written system inventory may be enough. Do not commission a new ERP or website merely because an AI-assisted attack made the news.

The next step is to document your internet-facing systems, privileged users and available logs, then ask the responsible technology provider to test the gaps. If the problem is a disconnected website, portal or workflow rather than a security incident, talk to us about the relevant build or automation scope.