Between late September and early October, several South Korean banks suffered data breaches. Shinhan Bank reported 25,000 affected customers, KB Kookmin Bank confirmed 119 leaks, Hana Bank identified 89, and BNK reported 11. The attackers accessed names, phone numbers, income data, and national ID numbers.
CrowdStrike reported on October 7 that attackers used open directories on their servers to store session logs. These logs revealed the use of Claude Code, an AI assistant, to inquire about platforms for selling stolen data, specifically targeting Korean Telegram groups. The attacker also requested a résumé highlighting their penetration testing results.
The investigation identified the use of ARTEX, a Chinese-developed open-source penetration testing tool. The infrastructure relied on a Hong Kong-based server. The attacker utilized several AI models, including DeepSeek v4.1-flash, Zhipu AI’s GLM-5.3, and xAI’s Grok 4.6. CrowdStrike assesses with moderate confidence that the actor is a financially motivated Chinese speaker.
The attacker’s session logs contained a Telegram handle, an age of 26, and a location in Maoming, Guangdong. This same handle was previously linked to probes of a Telegram-based NFT marketplace. South Korean police have launched an investigation into the incidents, which have raised significant public concern regarding the role of AI in cyberattacks.
