South Korea – October 12, 2026 -- CrowdStrike Intelligence has linked a late-September to early-October 2026 campaign against South Korean financial organizations, which resulted in exfiltrated data, to attacker servers that exposed Claude Code session histories, ARTEX configuration files and Claude memory files.