CrowdStrike details AI-assisted breaches of South Korean financial firms

CrowdStrike said the campaign was active from late September to early October 2026.[1] It identified ARTEX, an open-source AI-powered penetration-testing tool developed in China, as part of the operation.[2] CrowdStrike identified DeepSeek v4.1-flash as ARTEX’s primary model backend.[1] It also said additional Claude Code sessions used GLM-5.3 from Zhipu AI and Grok 4.6.[1] CrowdStrike assessed that the operator likely accessed DeepSeek through xcai.pro, which it described as an LLM API proxy or reseller.[1] The findings describe tools used in the operation, not evidence that the model providers knowingly supported it.[1]

CrowdStrike traced the operation to a two-server setup: a Hong Kong server serving as the primary environment and another hosting ARTEX.[2] It said exposed operational files documented the attacker’s infrastructure, prompts and workflows.[1] Compromised systems included a bank loan-inquiry service used by financial brokers and a separate employee mobile work-support system at a bank.[2] Those details give security teams specific service types and operational artifacts to consider when assessing exposure.[1][2] CrowdStrike’s evidence characterized the activity as AI-assisted intrusions carried out by a human operator, rather than an independently operating AI attacker.[1]

The Korea Times reported that seven South Korean financial firms had reported information leaks, naming Shinhan Bank, KB Kookmin Bank, Hana Bank, Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.[3] It said more than 67,000 people were believed to have been affected across those firms.[3] Reported leaked information included names, contact details, resident registration numbers, annual income and loan limits.[3] Separately, Reuters reporting linked to CrowdStrike said Shinhan Bank reported personal information compromised for about 25,000 customers, while KB Kookmin Bank reported leaks affecting 119 customers.[1] CrowdStrike cautioned that the broader count did not establish nine confirmed victims of this campaign.[1]

CrowdStrike assessed with moderate confidence that the unidentified operator was likely Chinese-speaking and financially motivated, but said the campaign had not been attributed to a named adversary.[1][2] Recovered sessions showed the operator asking Claude where criminals sell Korean breach information and for Korean Telegram data-sales groups.[1] CrowdStrike said those requests supported a profit-driven interpretation but did not establish that stolen records had been sold.[1] CrowdStrike also reported that a Telegram account linked to the bank hackings had been listed as a moderator of the GodNet community in September 2024.[4] Logpresso said those account links did not establish who carried out the hacks or whether one person was behind them.[4] ARTEX’s developer said it would stop updating the tool and switch to a closed-source model because of misuse.[4]