CrowdStrike says China-based suspect used AI tools in South Korean bank hacks

By Kyu-seok Shim and Brenda Goh

SEOUL, Oct 8 (Reuters) - The suspect behind recent cyberattacks targeting South Korea's financial sector may be a 26-year-old based in China's Guangdong province who used a Chinese-developed AI agent tool called ARTEX and Anthropic's Claude Code, US cybersecurity firm CrowdStrike said.

In a report published on Wednesday, CrowdStrike said it uncovered personal details linked to the suspected attacker while analysing AI coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October.

The case is likely to intensify concerns over the rise of AI agents and whether organisations are prepared to defend their systems against them.

Australia said last month that an OpenAI autonomous agent breached a government health statistics portal in June, marking one of the first known instances of an AI agent hacking a government system.

CrowdStrike said the attacker used ARTEX, a recently released Chinese-developed open-source penetration testing tool, alongside large language models such as Claude.

"While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated," it said.

"This assessment is made with moderate confidence based on the use of the Chinese-developed tool ARTEX and observed Chinese-language prompts."

BANK HACKS

CrowdStrike said the individual also asked Claude where threat actors typically sell Korean data breach information and sought assistance in finding Korean Telegram data sales groups.

In another session, the person also requested Claude to create a security researcher resume, which included details such as a Telegram account, age, educational background and a location in Maoming, a city in the southern Chinese province of Guangdong, which CrowdStrike said likely belonged to the attacker.

A man who answered a phone number provided by CrowdStrike in its report said he had no knowledge of the matter.

Anthropic, South Korean police and China's foreign ministry did not immediately respond to requests for comment.

ARTEX is an open-source AI agent for automated penetration testing that was published on GitHub this year by a Chinese security engineer with the handle Autumn. It is not a standalone large language model but connects to external LLMs such as ChatGPT, Claude and DeepSeek to help organisations test for vulnerabilities in the networks.

The tool’s GitHub page says it is intended for personal learning, code research and local technical verification and should not be used to conduct real-world testing against online systems or websites.

At least nine South Korean banks have disclosed or have been reported by local media as having been targeted by cyberattacks since late September, prompting South Korean police to launch a probe this week and President Lee Jae Myung to call for robust response measures.

Shinhan Bank said last week that personal information of about 25,000 of its customers was compromised, while KB Kookmin Bank said that the personal information of 119 of its customers was leaked.

(Reporting by Kyu-seok Shim and Brenda Goh. Additional reporting by Maggie Grether in Seoul and Eduardo Baptista in Beijing; Editing by Chris Reese and Ed Davies)