A series of cyberattacks against South Korean financial institutions has revealed how AI tools are making it easier for a single attacker to carry out complex hacking operations.
Cybersecurity firm CrowdStrike says a likely Chinese-speaking, financially motivated hacker used an AI-powered penetration testing tool developed in China alongside several large language models, including Anthropic’s Claude Code, during attacks on South Korean banks between late September and early October.
The investigation has linked the activity to attacks involving institutions including Shinhan Bank, KB Kookmin Bank, and Hana Bank. South Korean authorities have launched investigations into the incidents, while reports indicate that some affected systems contained customer information.
How AI Was Used in the Attacks?
CrowdStrike identified ARTEX as one of the main tools used during the campaign. The open-source penetration testing tool was developed in China and is designed to use AI agents to assist with security testing and other technical tasks.
The attacker also used several AI models during the operation. CrowdStrike said DeepSeek V4.1-Flash was the primary model, with GLM-5.3 and Grok 4.6 also appearing in the activity. Claude Code sessions were found among the records recovered by investigators.
The evidence shows that Claude was part of a wider collection of AI tools rather than the only system used in the attacks.
Investigators found exposed files containing Claude Code session histories, ARTEX configuration files, and other information connected to the operation. Some of the recovered activity also showed the attacker asking about marketplaces where stolen South Korean data could potentially be sold and Telegram groups associated with those markets.
At Least Nine South Korean Banks Were Targeted
CrowdStrike said the campaign affected multiple South Korean financial organisations. The compromised systems included a loan inquiry service used by financial brokers and a mobile work-support system used by employees at another bank.
Local reports have also linked the broader series of attacks to several other financial institutions, but the full extent of the intrusions and the total amount of data taken have not been confirmed.
CrowdStrike assessed with moderate confidence that the attacker was a Chinese speaker and financially motivated, based partly on Chinese-language prompts and the use of ARTEX. But the cybersecurity firm has not attributed the operation to a named hacking group.
The Attacker’s Identity Remains Unconfirmed
CrowdStrike also found infrastructure connected to the campaign, including a server in Hong Kong that investigators believe served as the attacker’s primary infrastructure and another server hosting ARTEX.
Investigators recovered personal details from one Claude Code session that appeared to describe the person behind the operation. However, CrowdStrike cautioned that these details were not reliable enough to establish the attacker’s identity with certainty.
The attacks highlight how AI agents and automated security tools are changing the scale of cybercrime. A single operator can now combine several AI systems with specialised tools to automate parts of an intrusion that would previously have required considerably more manual work.
For South Korean banks, the next step remains determining exactly what was accessed and what customer information may have been exposed. And for the wider cybersecurity industry, the case provides another clear example of how quickly AI tools are becoming part of real-world hacking operations.
