CrowdStrike links South Korean bank breaches to an attacker using AI agents

The security firm CrowdStrike published an analysis of a campaign against South Korean financial organisations between late September and early October 2026. The attacker used ARTEX, an open-source agentic penetration-testing tool recently released in China, together with several large language models. BleepingComputer named Shinhan Bank, KB Kookmin Bank and Hana Bank among the banks breached. It reported that client personal data and card details were exposed, that some systems went down, and that the South Korean government held an emergency meeting. CrowdStrike itself said the number of organisations affected was unconfirmed, and drew its account of the victims from industry reporting. The Kyunghyang Shinmun, the Korean newspaper CrowdStrike cited, reported on 4 October that the Financial Services Commission had convened bank chiefs that day, that the intrusions ran from 27 to 30 September, and that 25,727 items of personal data were taken at Shinhan Bank, where the attacker reached a loan-progress inquiry service used by brokers; at KB Kookmin Bank it reached an employee mobile work-support system. That paper’s list of affected firms also included smaller lenders such as Yegaram Savings Bank and Hyundai Capital.

The evidence came from the attacker’s own infrastructure. CrowdStrike found open directories holding Claude Code session histories, ARTEX configuration files and Claude memory files. Its reading of them was that the ARTEX instance ran on DeepSeek V4.1 Flash as its main model, likely reached through an API reseller, with Zhipu’s GLM-5.3 and xAI’s Grok 4.6 driving further Claude Code sessions. The logs also showed the attacker asking Claude where stolen Korean data is usually sold and how to find Korean Telegram groups that trade it.

In one session the attacker asked Claude to write a security researcher’s CV that listed the results of the attacks, and supplied personal details for it. CrowdStrike said those details probably belonged to the attacker but could not confirm the identity. It assessed with moderate confidence that the actor was a Chinese speaker motivated by money, and did not attribute the campaign to a known group. BleepingComputer reported that ARTEX’s developer made the project closed-source after learning it had been used in real attacks.

The case came less than two weeks after Anthropic reported that GLM-5.3, one of the models in this toolchain, could build working cyber exploits. Here, openly available agent tooling was tied to bank breaches in the wild, and the attacker’s own model logs supplied the evidence.