AI news · Security · finance
CrowdStrike ties Korean bank hacks to an AI agent tool
The security firm says a likely Chinese-speaking attacker ran the open-source ARTEX agent with several AI models.
CrowdStrike says the attacker behind a wave of South Korean bank breaches worked with an AI agent. In a report published on Wednesday 7 October 2026, the security firm said the campaign, which ran from late September into early October, used ARTEX, a recently released open-source penetration tool developed in China, alongside large language models, Infosecurity Magazine reports.
CrowdStrike linked the attacks through one IP address that hosted an ARTEX instance and a Claude Code prompt file; a second address, in Hong Kong, held open folders of session histories. The instance ran on DeepSeek V4.1 Flash, with GLM-5.3 and Grok 4.6 in other sessions. In one session the attacker asked Claude where stolen Korean data is sold. CrowdStrike judges, with moderate confidence, that the actor is a financially motivated Chinese speaker; it names no group.
Shinhan Bank has said data on about 25,000 customers was taken. According to the Reuters account on CNA, Reuters counts at least nine Korean banks named as targets, by themselves or local media, since late September, and police have opened an inquiry. ARTEX’s GitHub page says it should not be used against live systems. Reuters says Anthropic did not immediately respond to requests for comment.
For any firm holding customer data, CrowdStrike’s finding is that one attacker with agent tools can now work through several targets in quick succession.
Sources
- Infosecurity Magazine: Chinese Hacker Deployed AI in Campaign Against South Korean Banks. Checked
- CNA (Reuters): CrowdStrike says China-based suspect used AI tools in South Korean bank hacks. Checked
Alexandre S.
Alexandre S. is a creative ad strategist and copywriter with ten years' experience in digital marketing across multiple channels.