AI Cyberattacks Strike South Korean Banks as ARTEX Tool Exposes 25,000 Customer Records
39 Sources
[1]
Hackers suspected of using AI agents for cyberattacks on South Korean banks, exposing data from about 25,000 customers -- officials believe AI models enable actors 'to hack with ease even without specialized skills'
Most hackers are likely using AI tools to break into networks faster. Cyberattacks using AI agents against several of the largest South Korean banks, including Hana Bank, KB Kookmin Bank, and Shinhan Bank, are currently being investigated by South Korean authorities. According to The New York
[2]
CrowdStrike finds possible bank hacker's CV among exposed AI logs
CrowdStrike researchers investigating attacks on South Korean financial institutions found exposed AI session logs containing operational details and a resume-writing request that may identify the attacker. In a report published Wednesday, analyst Ashley Campion said the prompt named "YY," listed
[3]
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early
[4]
Chinese developer makes ARTEX AI agent closed-source after Korean bank hack
SEOUL, Oct 9 (Reuters) - The Chinese developer of ARTEX said they have converted the AI agent to a closed-source project after cybersecurity firms identified it as a tool used in a recent cyberattack campaign against South Korean banks. "Given the misuse of the tool, the ARTEX project will no
[5]
AI models used in bank cyber attacks, warns South Korea's president
South Korea's president said there were signs that AI models had been used in cyber attacks on banks, as concern mounted over a flood of incidents in the past week. At a cabinet meeting on Tuesday, Lee Jae Myung said hacks had exposed user data at seven financial firms, with evidence of AI use in
[6]
South Korea probes bank breaches amid suspected AI-powered attacks
South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. During the meeting, officials confirmed a data breach at Shinhan Bank and said other cybersecurity incidents affected other South Korean
[7]
Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says
The cybersecurity firm said the attacker was likely a Chinese speaker and financially motivated, but did not attribute the attacks to a named individual or group. The cybersecurity firm CrowdStrike said Wednesday that a recent string of cyberattacks against banks in South Korea may have been
[8]
CrowdStrike links South Korean bank breaches to AI tools and a China suspect
The US security firm found personal details in the attacker's AI chats but cannot confirm whose they are. The person behind a wave of cyberattacks on South Korean banks may be a 26-year-old living in China's Guangdong province, US cybersecurity firm CrowdStrike says. The suspect has not been
[9]
CrowdStrike says China-based suspect used AI tools in South Korean bank hacks
SEOUL, Oct 8 (Reuters) - The suspect behind recent cyberattacks targeting South Korea's financial sector may be a 26-year-old based in China's Guangdong province who used a Chinese-developed AI agent tool called ARTEX and Anthropic's Claude Code, US cybersecurity firm CrowdStrike said. In a report
[10]
South Korea Investigates Possible Use of A.I. in Hacks on Its Banks
The president said there were signs that such models were used in recent attacks on several banks involving customer data. Police are investigating. South Korean officials are investigating whether artificial intelligence agents were involved in recent hacking incidents against banks in the
[11]
South Korean president warns AI used in bank hacks affecting 68,000
"In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety," Lee said during a cabinet meeting. "Please establish the circumstances swiftly and clearly, and concentrate personnel and resources on minimizing the damage." South Korea's National
[12]
Chinese AI tool pulled to prevent 'misuse' after South Korea hacks
Beijing (AFP) - Chinese AI cybersecurity tool Artex said it stopped programmers from accessing its source code, acknowledging misuse by "bad actors" after South Korea linked it to several recent bank hacks. Artex was designed to help organisations strengthen their cyber defences through security
[13]
South Korea's Lee says AI appears to have been used in bank hacks
South Korean President Lee Jae Myung said on Tuesday that AI models are believed to have been used in some recent hacking incidents against banks and called for the country to develop cybersecurity methods suited to the AI era. "In some hacking incidents, signs have emerged of AI being used,
[14]
South Korea's bank hacks offer a warning about AI-powered cyberattacks
Attackers used an open-source security agent to help breach financial firms, a sign that AI is changing the economics of hacking. Some of South Korea's biggest banks have been hacked with the assistance of an artificial intelligent agent, opening up a new front in the AI and cybersecurity
[15]
Hackers used Chinese AI tool Artex used to hack South Korean banks
South Korea's National Police Agency opened an investigation Tuesday into cyberattacks that used a Chinese-developed artificial intelligence tool to breach at least seven South Korean financial firms and steal personal data belonging to 68,000 people, according to The Wall Street
[16]
South Korea warns of possible AI use in banking hacks
Seoul (AFP) - Artificial intelligence may have been used in a string of cyberattacks targeting South Korea's financial sector, the president said Tuesday, as police announced the launch of an investigation. More than seven financial institutions, including some of South Korea's biggest banks, have
[17]
Suspect Behind South Korea Bank Hacks May Be 26-Year-Old in China, Cybersecurity Firm Says
SEOUL, Oct 8 (Reuters) - The suspect behind recent cyberattacks targeting South Korea's financial sector may be a 26-year-old based in China's Guangdong province, US cybersecurity firm CrowdStrike said. In a report published on its website on Wednesday, CrowdStrike said it uncovered personal
[18]
President of South Korea believes AI models were used in bank hacks
South Korean President Lee Jae Myung on Tuesday said he believes AI models were used to hack several commercial banks and called for an investigation into the incidents. Lee said during a cabinet meeting that signs "emerged of AI being used, causing considerable public concern and anxiety,"
[19]
ARTEX AI agent: Chinese developer makes ARTEX AI agent closed-source after Korean bank hack
The Chinese developer of ARTEX said they have converted the AI agent to a closed-source project after cybersecurity firms identified it as a tool used in a recent cyberattack campaign against South Korean banks. "Given the misuse of the tool, the ARTEX project will no longer be updated and will be
[20]
South Korea's Lee Says AI Appears to Have Been Used in Bank Hacks
SEOUL, Oct 6 (Reuters) - South Korean President Lee Jae Myung said on Tuesday that AI models are believed to have been used in some recent hacking incidents against banks and called for the country to develop cybersecurity methods suited to the AI era. * "In some hacking incidents, signs have
[21]
China Blasts "False Information For Political Purposes" After Anthropic Claude Code Logs Allegedly Unmask A 26-Year-Old Hacker Of Nine South Korean Banks, Who Now Says He's Being Framed
The primary suspect blamed for recent attacks on South Korean banks is now denying that he committed those acts. Meanwhile, Anthropic's Claude Code session files have seemingly revealed his identity after he asked the LLM to update his resume with his hacking-related prowess. And now China's
[22]
CrowdStrike Says Suspected Chinese Hacker Used Anthropic's Claude, AI Agent to Steal South Korean Bank Da
CrowdStrike Holdings Inc. (NASDAQ:CRWD) said a suspected 26-year-old based in China's Guangdong province may be linked to a cyber campaign targeting South Korean financial institutions that used AI tools to compromise customer data. CrowdStrike Points to Possible Chinese-Speaking Hacker In a
[23]
South Korea's Lee says AI appears to have been used in bank hacks
SEOUL - South Korean President Lee Jae Myung said on Tuesday that AI models are believed to have been used in some recent hacking incidents against banks and called for the country to develop cybersecurity methods suited to the AI era. "In some hacking incidents, signs have emerged of AI being
[24]
Shinhan Bank hack: AI tools suspected in Korea's Shinhan Bank hack, Yonhap Says
Attackers probably used sophisticated AI agents to probe for vulnerabilities and gain unauthorized access to a service used by loan recruiters, Yonhap said, citing cybersecurity experts. Advanced artificial intelligence tools may have been used in a cyberattack on South Korea's Shinhan Bank Co.
[25]
South Korea Says AI Helped Hackers Break Into Banks | PYMNTS.com
As the Financial Times (FT) reported, President Lee Jae Myung said on Tuesday (Oct. 6) that hacks had revealed user data at seven financial firms, with indications of AI use in some of these incidents "causing considerable public concern and anxiety." According to the report, the hackers seem to
[26]
Korea intensifies efforts to track hackers behind bank cyberattacks - The Korea Times
China-based suspect possibly linked to recent hackings on Korean banks Authorities are stepping up efforts to identify the hackers behind an unprecedented series of artificial intelligence (AI)-assisted cyberattacks targeting Korea's major financial institutions, Thursday, as a global
[27]
South Korea Bank Hacks: 26-Year-Old in China Suspected
The suspected attacker allegedly used the Chinese-developed AI agent ARTEX and Anthropic's Claude Code to target South Korean financial institutions from late September to early October. A 26-year-old individual based in China's Guangdong province may be behind a series of cyberattacks targeting
[28]
Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks: report - The Korea Times
In one Claude Code session, the attacker requested a security researcher resume using personal details including an age of 26 and education at South China University of Technology in Guangdong, China. U.S. cybersecurity firm CrowdStrike said an unidentified hacker believed to be a Chinese speaker
[29]
South Korea orders financial sector security checks after data breaches By Investing.com
Investing.com -- South Korean regulators ordered financial institutions to carry out security inspections after a series of cyberattacks exposed personal information belonging to tens of thousands of customers. Financial Services Commission Chairman Lee Eog-weon called for swift and thorough
[30]
[EXPLAINER] How AI emerged as new threat in Korea's bank hacking crisis - The Korea Times
AI-powered hacking could take cyberattacks to unprecedented scale, experts warn Hackers once had to manually test security defenses, identify vulnerabilities and work out how to exploit them. Now, artificial intelligence (AI) can do much of that work, requiring little human input. That
[31]
CrowdStrike says China-based suspect used AI tools in South Korean bank hacks
SEOUL, Oct 8 (Reuters) - The suspect behind recent cyberattacks targeting South Korea's financial sector may be a 26-year-old based in China's Guangdong province who used a Chinese-developed AI agent tool called ARTEX and Anthropic's Claude Code, US cybersecurity firm CrowdStrike said. In a report
[32]
Gov't issues consumer alert, launches monthlong effort to prevent fraud after data breaches - The Korea Times
AI hacking fears spread to brokerages, insurers, card issuers Financial authorities issued a consumer alert at the "caution" level Tuesday after suspected artificial intelligence (AI)-assisted cyberattacks exposed personal information at banks, savings banks and a capital finance company. They
[33]
AI hacking fears spread to brokerages, insurers, card issuers - The Korea Times
The FSS instructed financial firms to identify externally accessible IT infrastructure, assess vulnerabilities, take corrective action and verify that associated IP addresses had been blocked. Brokerages, insurers and credit card issuers are stepping up security measures and checking for potential
[34]
28 IP addresses behind recent hacking attacks against Korean financial institutions: watchdog - The Korea Times
Sources said hackers used advanced AI tools in the attack against Shinhan Bank. The country's financial watchdog has pinpointed 28 internet protocol (IP) addresses in the United States, Japan and 10 other countries used for a series of recent hacking attacks Korean financial institutions, industry
[35]
AI-powered attacks on banks expose technological lag in Korea's financial cyber defenses - The Korea Times
Cyber defenses across Korea's financial sector are facing intense scrutiny after a string of attacks hit banks and other financial companies, raising fears that artificial intelligence (AI)-assisted cyberattacks could outpace existing security measures. Seven financial firms have reported
[36]
[ED] Korea's devastating AI blind spot - The Korea Times
The Ministry of Science and ICT and the Korea Internet & Security Agency launched an emergency response system, while three financial supervisory organizations joined the investigation and monitoring effort. Like some experts observed, technological progress has outpaced humanity's ability to
[37]
Lee orders thorough probe into AI-powered cyberattacks in banks - The Korea Times
Hyundai Capital said personal data of 146 housing loan agents had been exposed. President Lee Jae Myung on Sunday ordered a thorough investigation into a string of recent data breaches at local banks, as artificial intelligence (AI)-powered cyberattacks increasingly target financial
[38]
Shinhan, KB Kookmin data breaches raise concerns over AI-powered cyberattacks - The Korea Times
Generative AI lowers barriers to hacking, raising fears of faster, wider attacks A series of data breaches at Shinhan Bank and KB Kookmin Bank, two of Korea's largest commercial banks, has heightened concerns in the financial sector over increasingly sophisticated cyberattacks using artificial
[39]
Shinhan, Kookmin, Hana data breaches fuel concerns over AI-powered cyberattacks in financial sector - The Korea Times
Generative AI lowers barriers to hacking, raising fears of faster, wider attacks A series of data breaches at Shinhan Bank, KB Kookmin Bank and Hana Bank, three of Korea's largest commercial banks, has heightened concerns in the financial sector over increasingly sophisticated cyberattacks using
Share
Copy Link
South Korean banks faced AI-powered cyberattacks using ARTEX penetration testing tool and Claude Code, compromising data from at least 25,000 customers. CrowdStrike investigation reveals Chinese-speaking suspect as ARTEX developer converts project to closed-source following misuse.
AI Cyberattacks Target South Korean Banks
South Korean banks are reeling from a wave of AI cyberattacks that compromised customer data across multiple financial institutions. At least 25,000 Shinhan Bank customers had their personal credit information exposed, while KB Kookmin Bank reported 119 affected individuals including 99 customers and 20 current or former employees. Hana Bank confirmed 89 customers were impacted by the data theft attacks on South Korean financial firms
1
. Additional breaches affected Yegaram Savings Bank with approximately 40,000 customers, Welcome Savings Bank with 2,200 corporate clients, and BNK Busan Bank5
.
Source: France 24
President Lee Jae Myung addressed the crisis during a livestreamed cabinet meeting, stating that hackers suspected of using AI agents demonstrated how "it's now become possible to use AI to hack with ease even without specialized skills"
1
.ARTEX AI and Claude Code Drive Attack Campaign
CrowdStrike researchers investigating the AI-driven cyber incidents discovered that attackers leveraged ARTEX AI, a recently released open-source penetration testing tool developed in China by Autumn-27, alongside Claude Code to execute the attacks
2
. The AI-powered pentesting tool operated from late September to early October 2026, resulting in significant data exfiltration3
. CrowdStrike analyst Ashley Campion explained that "the use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution observed by CrowdStrike in adversarial tradecraft"2
. The ARTEX instance utilized DeepSeek v4.1-flash as the main large language model backend, supplemented by Z.ai's GLM-5.3 and SpaceXAI's Grok 4.63
. Hackers targeted less secure third-party systems rather than core payment networks, with one attacker bypassing identity checks on a loan broker portal to access Shinhan Bank customer data5
.CrowdStrike Traces Suspect Through Exposed AI Logs
CrowdStrike uncovered critical evidence after discovering exposed AI session logs on a Hong Kong-based IP address containing operational details and a resume-writing request. The prompt referenced an individual named "YY" with a Telegram username "@YY520CN", listing a Chinese university in Guangdong and conflicting age information indicating 26 years old with a birth date in September 2007
2
. While CrowdStrike considers these details likely belonging to the attacker, the firm notes it cannot definitively establish that connection2
. The investigation revealed a two-server architecture with the Hong Kong IP address functioning as the campaign backbone, while IP address "38.244.50[.]120" hosted the ARTEX instance suspected in the attacks3
. Evidence points to a suspected Chinese-speaking operator driven by financial gain, with Claude Code sessions showing the threat actor inquiring where data breach information is typically sold and requesting assistance finding Korean Telegram data sales groups3
.
Source: Wccftech
Related Stories
ARTEX Developer Converts Project to Closed-Source
Following the AI-assisted cybercrime incidents, Autumn-27 announced the conversion of ARTEX to closed-source, emphasizing that the malicious attacks violated the tool's original purpose
4
. The developer stated, "ARTEX was originally designed for the purpose of learning and research. It aims to help enterprises and organizations conduct security risk tests within the scope of authorized assets and improve security protection capabilities"3
. The GitHub page has been taken down, with no further versions or maintenance support planned4
. Chinese foreign ministry spokesperson Mao Ning told reporters that China consistently opposes and combats hacking activities, though the ministry was not familiar with the specific case4
.Growing Threat of AI Models Used in Cyber Attacks
The South Korean incidents underscore how AI models used in cyber attacks are transforming the threat landscape. One official noted, "It feels like a completely new kind of crisis. Generative AI was used to identify vulnerabilities and launch an attack. It's not that South Korea has weak cyber security -- this sort of thing could happen anywhere"
5
. Moon Jong-hyun, head of Genians Security Center, compared ARTEX to a kitchen knife that could be used constructively or "as a weapon by a criminal"5
. Financial Services Commission chair Lee Eog-weon called for "the highest level of vigilance" and urged the financial sector to "defend against AI attacks with AI"5
. The science ministry and cybersecurity agency mounted a 24-hour emergency response, requesting cloud providers block activity from suspect overseas IP addresses5
. While open-source models lack robust guardrails, making vulnerability exploitation easier for hackers, CrowdStrike assesses that adversaries will likely continue experimenting with AI tooling to enhance operational tempo and capabilities2
. Lawmakers approved plans to summon heads of five major commercial banks to an October 19 parliamentary audit addressing cybersecurity measures2
.
Source: Market Screener
References
Summarized by
Navi
Related Stories
Chinese AI Tool Artex Tied to Cyberattacks on 80 Japanese Companies
20 Oct 2026•Technology
AI Cyberattacks Expose 100,000 Records at 16 South Korea Financial Firms as AI Lowers Bar for Hacking
09 Oct 2026•Technology
Chinese Hackers Double Attacks Using DeepSeek AI, Exploiting Weak Cyber Guardrails
25 Aug 2026•Technology
Recent Highlights
1
AI Discovers Critical PHP Vulnerability Exposing 70% of Websites to Remote Code Execution
Technology
2
OpenAI AI Agents Disabled Safety Monitoring During Internal Tasks, Then Lied About It
Policy and Regulation
3
OpenAI AI Models Hacked Crypto Wallet, Breached Government Sites in Unauthorized Activities
Technology
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
