A suspected Chinese-speaking hacker used artificial intelligence tools to penetrate South Korean financial institutions and steal data, cybersecurity company CrowdStrike has found, as authorities investigate breaches affecting thousands of customers.CrowdStrike said its investigation uncovered evidence that the attacker combined ARTEX, a Chinese-developed automated penetration-testing tool, with Anthropic's Claude Code and several large language models during a campaign spanning late September and early October.
The findings, published on 7 October, link activity against multiple financial organisations to infrastructure containing exposed AI session histories, configuration records and operating instructions. CrowdStrike has not identified a named perpetrator and assesses with moderate confidence that the operator speaks Chinese and was motivated by financial gain.
A further development followed on 8 October when ARTEX's developer, using the online name Autumn-27, announced that the project would become closed-source and cease public updates and maintenance. The developer said the decision followed misuse of the software, originally intended to help organisations assess security weaknesses, and opposed unlawful deployment.
South Korean investigators have been examining intrusions affecting major lenders, including Shinhan Bank, KB Kookmin Bank and Hana Bank. Authorities have not independently established that ARTEX caused every reported breach, and CrowdStrike cautioned that the precise number of organisations compromised remains unconfirmed.
Data exposure has included information relating to approximately 25,000 Shinhan customers and 40,000 Yegaram Savings Bank customers. Another incident affected about 2,200 corporate customers of Welcome Savings Bank. Personal details obtained through such breaches can increase the risk of phishing, identity fraud and loan-related scams, even without direct theft of money.
President Lee Jae Myung raised the attacks at a cabinet meeting on 6 October, saying there were indications that artificial intelligence had been used. He called for prompt investigation and stronger measures to protect financial consumers. Police opened an investigation while financial regulators coordinated countermeasures with lenders.
The Financial Services Commission issued a consumer warning on 6 October, urging people potentially affected to remain alert to fraudulent messages and suspicious approaches. Financial authorities also convened an emergency meeting with institutions and sought closer monitoring of weaknesses that could expose additional records.
Investigators have examined weaknesses in services outside banks’ core transaction systems, including a loan application enquiry platform used by brokers and a mobile support service for employees. Such access points can contain sensitive customer information without giving intruders direct control over deposits or payment infrastructure.
CrowdStrike's technical examination centred on internet servers apparently controlled by the attacker. One hosted an ARTEX installation and a document containing Chinese-language instructions directing how an AI model should conduct penetration tests. Another server, located in Hong Kong, held Claude Code conversation histories, ARTEX settings and files recording earlier AI interactions.
Researchers determined that the infrastructure appeared to use two linked servers, one coordinating operations and the other running automated testing. The ARTEX deployment primarily drew on DeepSeek's v4.1-flash model, supplemented by GLM-5.3 and Grok 4.6 in additional Claude Code sessions.
Those records also showed a user asking Claude about places where stolen Korean information might be sold and seeking help locating Telegram groups dealing in such material. These exchanges indicate an interest in monetising compromised data, although they do not establish that any sale occurred.
One conversation included a request to prepare a cybersecurity résumé with personal details suggesting a 26-year-old individual associated with Maoming in China's Guangdong province. CrowdStrike said the information might belong to the operator but could not definitively connect that identity with the intrusions. The account also contained inconsistent age information.
China's foreign ministry spokesperson Mao Ning said on 8 October that she was unfamiliar with the case and reiterated China's opposition to hacking. The available technical findings do not establish involvement by the Chinese government, and the use of Chinese software or language alone does not demonstrate state sponsorship.
ARTEX was built for authorised security testing, where automated agents examine systems for vulnerabilities. Such tools can also be misused to accelerate reconnaissance and exploitation when directed at networks without permission. CrowdStrike described the campaign as an example of one financially motivated actor potentially conducting several intrusions over a compressed period.
The security firm's investigation also identified multiple proxy addresses used during the operations. Its published technical indicators are intended to help defenders look for connections to the infrastructure while individual banks continue assessing affected services and notifying customers about exposed information.
Topics
Technology