CrowdStrike says China-based suspect used AI tools in South Korean bank hacks
Top line
CrowdStrike attributes recent cyberattacks on South Korean banks to a China-based suspect leveraging AI tools like ARTEX and Claude Code.
Summary
According to U.S. cybersecurity firm CrowdStrike, recent cyberattacks targeting South Korean financial institutions may have been carried out by a 26-year-old suspect in Guangdong, China, who utilized AI tools including the Chinese-developed ARTEX and Anthropic's Claude Code. During these AI-assisted sessions, the suspect inadvertently exposed personal identifying information. The breaches have impacted at least nine South Korean banks, compromising customer data and prompting a police investigation alongside presidential calls for stronger security defenses.
Highlights
- CrowdStrike reported that recent cyberattacks targeting South Korean financial institutions may be linked to a 26-year-old suspect based in Guangdong, China.
- The suspect allegedly used a Chinese-developed open-source penetration testing tool called ARTEX along with Anthropic's Claude Code.
- CrowdStrike uncovered personal details, including a location in Maoming, Guangdong, and a Telegram account, by analyzing the attacker's AI coding-tool sessions.
- The attacker queried Claude about where to sell Korean data breach information and requested a fake security researcher resume.
- At least nine South Korean banks have reported cyberattacks since late September, leading to compromised customer data at institutions like Shinhan Bank and KB Kookmin Bank.
- South Korean police have launched a probe, and President Lee Jae Myung has called for robust response measures.
- ARTEX is an open-source AI agent for automated penetration testing published on GitHub, designed to integrate with external large language models such as Claude, ChatGPT, and DeepSeek.
Related Items