CrowdStrike says a China-based suspect may have used AI tools in South Korean bank hacks

CrowdStrike said a campaign against South Korean banks from late September may be linked to a 26-year-old in Guangdong who used the ARTEX tool and Claude Code. It assessed that with moderate confidence and said the person is not identified.

A suspect behind recent cyberattacks on South Korea's financial sector may be a 26-year-old based in Guangdong who used a Chinese-developed tool called ARTEX and Anthropic's Claude Code, CrowdStrike said in a report published on Wednesday. Reuters reported the findings from Seoul.

CrowdStrike said it found personal details while analysing AI coding-tool sessions and infrastructure tied to a campaign against South Korean financial institutions from late September to early October. It assessed with moderate confidence that the actor was a Chinese speaker and likely financially motivated, based on ARTEX and Chinese-language prompts, and said the activity had not been attributed to a named adversary.

One Claude session asked where Korean breach data is typically sold and sought Telegram sales groups. Another asked for a security-researcher resume that included a Telegram account, age, education and a location in Maoming, Guangdong. CrowdStrike said those details likely belonged to the attacker. A man who answered a phone number in the report said he had no knowledge of the matter.

At least nine South Korean banks have been targeted or reported as targeted since late September. Shinhan Bank said personal information of about 25,000 customers was compromised. KB Kookmin Bank said information on 119 customers leaked. Police opened a probe, and President Lee Jae Myung called for a robust response. Anthropic, South Korean police and China's foreign ministry did not immediately comment.

CrowdStrike cautioned that available information does not identify the attacker. No arrest was announced with the report.

People Sentiments Negative

• CrowdStrike said the actor was likely a Chinese speaker and financially motivated, with moderate confidence, and that the activity was not attributed to a named adversary.