CrowdStrike links South Korean bank hacks to 26-year-old in China using AI coding tools
US cybersecurity firm CrowdStrike said the suspect behind attacks on South Korean financial institutions from late September to early October may be a 26-year-old in China's Guangdong province, who used the Chinese-developed ARTEX tool and Anthropic's Claude Code. CrowdStrike assessed with moderate confidence that the actor is a Chinese speaker and financially motivated, while noting no named adversary has been attributed. At least nine South Korean banks have been targeted, and Shinhan Bank said about 25,000 customers' data was compromised.
Bottom line — Shinhan Bank's roughly 25,000 affected customers and KB Kookmin Bank's 119 leaked records show how small the reported breaches are, yet the case feeds wider concern about AI agents.
Go deeper 8
-
CrowdStrike said the suspect asked Claude where stolen Korean data is sold and how to find Telegram groups that trade it, which the firm read as evidence of financial motive.
-
Reuters reports Australia said an OpenAI autonomous agent breached a government health statistics portal in June, one of the first known AI-agent intrusions into a government system.
-
ARTEX, published on GitHub this year, does not run its own model but connects to external LLMs including ChatGPT, Claude and DeepSeek; its GitHub page says it is meant for personal learning and not for testing live systems.
-
Yellow reports that CrowdStrike found the attacker's Claude Code session histories on open directories of attacker-controlled servers, and that ARTEX ran mainly on DeepSeek v4.1-flash.
-
The Korea Times reports CrowdStrike identified two servers, one in Hong Kong serving as primary infrastructure and another hosting ARTEX.
-
Yellow reports that on Oct. 3 a Korea Financial Security Institute official said investigators traced Shinhan attack logs to ARTEX and that the hacker did not act alone.
-
A man who answered a phone number listed in CrowdStrike's report told reporters he had no knowledge of the matter; Anthropic, South Korean police and China's foreign ministry did not respond to requests for comment.
-
The Korea Times notes the attacker's identity, the full extent of the breaches and the volume of stolen data remain unconfirmed.