AI-assisted attacks hit South Korean financial institutions

• 

  CrowdStrike says an attacker used the ARTEX AI penetration-testing tool and large language models in attacks on South Korean financial institutions from late September to early October 2026.

• 

  The attacks resulted in stolen data, and exposed server directories revealed AI session histories, configuration files and memory files documenting the activity.

• 

  The Register, citing The Korea Times, reports that at least five lenders were affected, while Security Affairs says the total number has not been confirmed.

• 

  CrowdStrike assessed that the operator was likely financially motivated and Chinese-speaking, but did not link the activity to a specific group.

• 

  The exposed logs included a résumé-writing request with personal details that CrowdStrike said may belong to the attacker but could not definitively connect to them.

Who

An attacker CrowdStrike assessed was likely Chinese-speaking and financially motivated. The activity has not been linked to a specific group.

What

Attacks using ARTEX and large language models targeted South Korean financial institutions and resulted in stolen data.

When

From late September to early October 2026.

Where

South Korean financial institutions; exposed infrastructure included servers in Hong Kong and at 38.244.50[.]120.

Why

CrowdStrike assessed the operator was financially motivated. The sources do not state a definitive motive for each attack.

This story does not have two clearly opposing sides.