Stories
China-based suspect used AI tools in South Korean bank hacks, CrowdStrike says
- •CrowdStrike revealed that a 26-year-old suspect based in Guangdong, China, likely orchestrated cyberattacks against South Korean financial institutions using AI tools like ARTEX and Anthropic's Claude Code.
- •The attacker leveraged the Chinese-developed penetration testing tool ARTEX and large language models to query data breach sales groups and even generate a resume containing personal details.
- •At least nine South Korean banks have been targeted since late September, leading to data leaks at institutions such as Shinhan Bank and KB Kookmin Bank.
- •South Korean police have launched an investigation into the breaches, and President Lee Jae Myung has called for robust response measures.
Key Questions Answered
According to cybersecurity firm CrowdStrike, the suspect utilized a Chinese-developed open-source penetration testing tool called ARTEX alongside Anthropic's Claude Code and other large language models. ARTEX connects to external LLMs like ChatGPT, Claude, and DeepSeek to assist in vulnerability testing.
At least nine South Korean banks have disclosed or been reported by local media as targets of cyberattacks since late September. Affected institutions include Shinhan Bank and KB Kookmin Bank, which reported customer data leaks, alongside Hana Bank and Woori Bank.
CrowdStrike uncovered personal details and Chinese-language prompts during AI coding-tool sessions, including a request to create a security researcher resume listing a location in Maoming, Guangdong province. Based on the use of the Chinese tool ARTEX and local prompts, investigators assess with moderate confidence that the attacker is a Chinese speaker based in Guangdong.
