Crowdstrike has identified a security breach affecting several financial institutions in South Korea. The incident occurred between late September and early October 2026 and is attributed to a single attacker who likely speaks Chinese. The breach resulted in the theft of significant volumes of sensitive data from the targeted organizations.
At Shinhan Bank, the intruder compromised over 25 000 records, including customer names, contact information, income data, and credit limits. In response to the incident, the South Korean financial regulator convened an emergency meeting, while President Lee Jae Myung ordered a comprehensive investigation into the matter.
The attacker utilized ARTEX, an open-source tool published on GitHub in July 2026. This software leverages AI language models, specifically DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, to automate penetration testing and identify security vulnerabilities. Researchers also discovered Claude Code session logs in the attacker's directories.
Evidence suggests the intruder searched for Telegram groups to facilitate the sale of the stolen information. Crowdstrike notes that this case highlights the growing risk of AI-powered tools enabling individuals to conduct large-scale cyberattacks. Anthropic recently reported that the GLM-5.3 model can generate exploits comparable to its own Mythos Preview.
