Cybersecurity firm CrowdStrike says the suspect behind a recent wave of cyberattacks on South Korea's financial sector may be a 26-year-old based in China's Guangdong province who used artificial-intelligence tools to carry out the intrusions. The findings were published on the firm's website on Wednesday.
What investigators found
CrowdStrike said its analysts uncovered personal details linked to the suspected attacker while examining AI coding-tool sessions and infrastructure tied to a campaign targeting South Korean financial institutions from late September into early October. The intruder reportedly used ARTEX, a recently released Chinese-developed open-source penetration-testing tool, alongside large language models.
In one session using Claude Code, the attacker allegedly asked the AI to draft a security-researcher resume containing personal details: age 26, a Telegram account, an education background reportedly at the South China University of Technology, and a location in Maoming, Guangdong. The same Telegram username surfaced in other cyber activity, including vulnerability research on a Telegram-based NFT marketplace and a suspected attack on a Chinese payment platform.
Attribution comes with caveats
The firm assessed with "moderate confidence" that the actor is a Chinese speaker and likely financially motivated, citing the Chinese-developed tool and observed Chinese-language prompts. It stressed the campaign is not attributed to any named adversary group. CrowdStrike cautioned that the personal details uncovered likely belonged to the actor but could not definitively identify the attacker — the identity, the full extent of the breaches, and the amount of any stolen data remain unconfirmed.
Banks that reported breaches include Shinhan Bank, KB Kookmin Bank and Hana Bank. Compromised systems reportedly included a bank's loan-inquiry service used by financial brokers and another bank's mobile work-support system for employees.
South Korea responds
South Korean police have opened a probe into the incidents. President Lee Jae Myung said on Tuesday that signs had emerged that AI was used in some of the attacks and called for heightened cybersecurity measures across the sector.
The case adds to a growing list of incidents where AI coding assistants have accelerated real-world cyberattacks — and where the tools themselves left traces that investigators could follow.
Sources:
Reuters: Suspect behind South Korea bank hacks may be 26-year-old in China, cybersecurity firm says
The Japan Times: South Korea bank hack suspect may be 26-year-old in China, U.S. firm says
The Korea Herald: Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks
What investigators found
CrowdStrike said its analysts uncovered personal details linked to the suspected attacker while examining AI coding-tool sessions and infrastructure tied to a campaign targeting South Korean financial institutions from late September into early October. The intruder reportedly used ARTEX, a recently released Chinese-developed open-source penetration-testing tool, alongside large language models.
In one session using Claude Code, the attacker allegedly asked the AI to draft a security-researcher resume containing personal details: age 26, a Telegram account, an education background reportedly at the South China University of Technology, and a location in Maoming, Guangdong. The same Telegram username surfaced in other cyber activity, including vulnerability research on a Telegram-based NFT marketplace and a suspected attack on a Chinese payment platform.
Attribution comes with caveats
The firm assessed with "moderate confidence" that the actor is a Chinese speaker and likely financially motivated, citing the Chinese-developed tool and observed Chinese-language prompts. It stressed the campaign is not attributed to any named adversary group. CrowdStrike cautioned that the personal details uncovered likely belonged to the actor but could not definitively identify the attacker — the identity, the full extent of the breaches, and the amount of any stolen data remain unconfirmed.
Banks that reported breaches include Shinhan Bank, KB Kookmin Bank and Hana Bank. Compromised systems reportedly included a bank's loan-inquiry service used by financial brokers and another bank's mobile work-support system for employees.
South Korea responds
South Korean police have opened a probe into the incidents. President Lee Jae Myung said on Tuesday that signs had emerged that AI was used in some of the attacks and called for heightened cybersecurity measures across the sector.
The case adds to a growing list of incidents where AI coding assistants have accelerated real-world cyberattacks — and where the tools themselves left traces that investigators could follow.
Sources:
Reuters: Suspect behind South Korea bank hacks may be 26-year-old in China, cybersecurity firm says
The Japan Times: South Korea bank hack suspect may be 26-year-old in China, U.S. firm says
The Korea Herald: Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks
