Archive · 8 Oct 2026
CrowdStrike Links AI Tools to South Korean Bank Attacks
CrowdStrike says someone may have used AI tools during attacks on banks in South Korea.
The suspected person may be 26 and live in China’s Guangdong province, but this has not been confirmed.
CrowdStrike said the tools included ARTEX and Claude Code.
ARTEX is designed to help test computer networks for weaknesses.
Its GitHub page says it should not be used to test real online systems or websites.
CrowdStrike also said the person asked Claude about selling stolen Korean data.
At least nine South Korean banks were reported as targets starting in late September.
Two banks said some customer information was exposed.
South Korean police are investigating, and CrowdStrike has not named a confirmed attacker.
CrowdStrike said a suspected attacker may be a 26-year-old based in China’s Guangdong province, but it has not attributed the activity to a named adversary.
The company said the campaign used ARTEX, an open-source penetration-testing AI agent, alongside large language models including Anthropic’s Claude.
CrowdStrike assessed with moderate confidence that the actor was likely Chinese-speaking and financially motivated, citing Chinese-language prompts and ARTEX use.
At least nine South Korean banks have disclosed or been reported as targets since late September; police opened an investigation this week.
Shinhan Bank reported about 25,000 customers’ personal information compromised, while KB Kookmin Bank reported information belonging to 119 customers leaked.
- Who
- CrowdStrike reported on a suspected attacker who may be a 26-year-old based in Guangdong, China; the activity has not been attributed to a named adversary.
- What
- Cyberattacks targeted South Korean financial institutions, and CrowdStrike said AI tools were used in activity associated with the campaign.
- When
- The campaign ran from late September to early October; CrowdStrike published its report on Wednesday.
- Where
- South Korean financial institutions were targeted; the suspected attacker may be based in Guangdong, China.
- Why
- CrowdStrike assessed with moderate confidence that the activity was financially motivated.
CrowdStrike’s assessment
Caveats and stated tool purpose
Suspect and attribution
CrowdStrike’s assessment
CrowdStrike said the suspect may be a 26-year-old in Guangdong and assessed with moderate confidence that the actor was likely Chinese-speaking and financially motivated.
Caveats and stated tool purpose
CrowdStrike said the activity has not been attributed to a named adversary. A man who answered a phone number cited in the report said he had no knowledge of the matter.
ARTEX’s use
CrowdStrike’s assessment
CrowdStrike said ARTEX was used alongside large language models in activity targeting South Korean financial institutions.
Caveats and stated tool purpose
ARTEX’s GitHub page describes it as a tool for learning, code research, and local technical verification, and says it should not be used against real online systems or websites.
- Suspected attacker
- Possibly a 26-year-old based in Guangdong, China; not confirmed
- Tools cited
- ARTEX and Anthropic’s Claude Code
- Campaign period
- Late September to early October
- Banks targeted
- At least nine South Korean banks disclosed or were reported as targets
- Shinhan Bank
- Reported that personal information of about 25,000 customers was compromised
- KB Kookmin Bank
- Reported that personal information of 119 customers was leaked
- Investigation
- South Korean police launched a probe this week
