fc.The Financial CurrentPublished by Paul Ivinskas
Back to newsfeed
Security research and reported breaches

Security firm ties South Korea bank breaches to an AI hacking agent

CrowdStrike says the attacker behind recent South Korean bank data breaches used ARTEX, an open-source AI penetration-testing agent, alongside AI coding tools. The activity has not been attributed to a named group.

Source / event date: October 7–9, 2026; CrowdStrike report and Reuters reporting

The Financial Current · https://thefinancialcurrent.com/news/2026-10-08-korea-bank-hacks-ai-agent

What investigators found

The data breaches at South Korean banks reported in early October now have a clearer picture of how they were carried out. In an October 7 report, CrowdStrike said a campaign against South Korean financial organizations, active from late September to early October, resulted in stolen data. [1]

CrowdStrike said the attacker used ARTEX, a recently released open-source tool developed in China that uses AI agents to probe systems for weaknesses, together with large language models. Open directories on servers controlled by the attacker held ARTEX configuration files and session histories from Claude Code, Anthropic’s coding assistant. The ARTEX setup itself ran mainly on a Chinese-developed AI model, CrowdStrike said. [1]

Those sessions also showed the attacker asking Claude where Korean breach data is typically sold and for help finding online chat groups that trade it, according to the report. [1]

CrowdStrike has not attributed the activity to a named adversary. It assessed with moderate confidence that the attacker is likely a Chinese speaker and financially motivated, based on the Chinese-developed tool and Chinese-language prompts. A résumé request in one session included personal details, but CrowdStrike said available information cannot definitively tie them to the attacker. [1]

The banks and the response

Reuters reported on October 8 that at least nine South Korean banks had disclosed or been reported as targets since late September. Shinhan Bank has said personal information for about 25,000 customers was compromised, and KB Kookmin Bank reported 119 affected customers. Police have opened an investigation, and President Lee Jae Myung called for response measures. [2]

“It allows one human to target many customers in a very short period of time using the power of AI,” CrowdStrike’s Adam Meyers told Reuters. China’s foreign ministry said it was not familiar with the case. [2]

Reuters reported on October 9 that the developer behind ARTEX made the tool closed-source and that its GitHub page had been taken down after the hacks drew attention. [3]

What remains uncertain

The number of affected institutions and customers is still being confirmed, and the figures come from the banks, authorities and news reports. CrowdStrike’s description of the attacker is an assessment, not a finding by police or a court, and no arrest had been reported. No theft of customer funds was reported in the cited coverage.

Sources

Coverage thread

Earlier coverage · Material follow-up on the same incidents; the attacker description is a security firm’s assessment, not a law-enforcement finding.

South Korea orders broad checks after a cluster of bank data breaches

What this adds: The October 2 article covered the breaches and South Korea’s regulatory response. This follow-up adds CrowdStrike’s October 7 assessment that the attacker used an open-source AI penetration-testing agent and AI coding tools, along with later reported counts of targeted banks and the police investigation.

Source / event date: Reuters and Korean reporting · October 1–2, 2026

Flag an error or suggest a correction →Public corrections log →

AI-assisted reportingMethodology