AI tools appeared in attacks on South Korean banks

GBHackers reported that attackers used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an agentic penetration-testing framework[1]. CrowdStrike confirmed ARTEX’s use, and described the suite as open-source and developed in China[4]. CrowdStrike said the ARTEX instance used DeepSeek v4.1-flash as its primary model, with GLM-5.3 from Zhipu AI and Grok 4.6 used in additional Claude Code sessions[2]. The reporting describes AI tools within a broader toolkit; available evidence does not establish how much AI accelerated the attacks[3].

The reported bank incidents did not point to one shared weakness across every institution: the wider investigation involved different services and types of data[1]. CrowdStrike said one intrusion involved a loan-progress inquiry service used by financial brokers, while another involved a bank employee mobile work-support system[2]. BleepingComputer named Shinhan Bank, KB Kookmin Bank and Hana Bank among the institutions targeted[4]. It also reported exposure of client personal data and credit card information, with system outages in some cases[4]. These details support assessing the affected service and data in each incident separately[1][4][2].

Public reporting cited by Recorded Future said the breaches exposed personal information belonging to at least 68,000 people across at least seven financial institutions[3]. Infosecurity Magazine reported figures from The Straits Times of 25,000 people affected at Shinhan Bank and 40,000 at Yegaram Savings Bank[2]. GBHackers said the exact number of affected organizations remains unconfirmed and that the campaign has not been attributed to a named adversary[5]. CrowdStrike assessed with moderate confidence that the attacker was Chinese-speaking and financially motivated; that assessment does not amount to a public attribution to a named actor[2][5].

Recorded Future said TAG-217 tested remote-access infrastructure and conducted internet scanning between August 17 and August 22, 2026; logs showed repeated connections between the actor’s own servers, but not successful access to victim systems[3]. The same reporting said the actor had assembled tools aimed at YiiMP cryptocurrency-mining operations by August 22, and that mobile-exploitation experiments did not demonstrate successful compromise[3]. South Korea’s government held an emergency meeting and called for immediate security measures for critical IT systems[4]. The Financial Services Commission issued a consumer alert about the attacks on October 6[2].