32
CrowdStrike has linked the use of artificial intelligence (AI) tools to cyberattacks targeting South Korean financial institutions, saying an
unidentified threat actor used AI-powered tools to breach systems and steal data.
The cybersecurity firm said the campaign was active from late September to early October 2026 and targeted multiple South Korean financial organisations. CrowdStrike assessed with moderate confidence that the threat actor was likely Chinese-speaking and financially motivated, but said the activity was not attributed to a named group.
According to CrowdStrike, the attacker used ARTEX, an open-source agentic penetration-testing tool developed in China, alongside large language models (LLMs). The firm identified Claude Code session histories, ARTEX configuration files and other data on infrastructure linked to the campaign.
CrowdStrike said the ARTEX setup primarily used DeepSeek v4.1-flash as its AI model backend, while other sessions involved GLM-5.3 from Zhipu AI and Grok 4.6. The tools were used alongside conventional offensive techniques during the attacks.
The investigation also found evidence suggesting a possible financial motive. CrowdStrike said the operator used Claude to seek information about where stolen Korean data could be sold and looked for Korean- language Telegram groups involved in data trading.
The campaign comes amid a series of cyber incidents affecting South Korean financial institutions. Shinhan Bank has reported the compromise of personal information belonging to about 25,000 customers, while KB Kookmin Bank disclosed a separate leak involving 119 customers. South Korean authorities are investigating the incidents.
The findings highlight concerns over the growing use of agentic AI in cyber operations. CrowdStrike said the combination of AI-powered tools and traditional attack techniques could enable threat actors to conduct intrusions more efficiently.
The incidents have added to concerns over the potential use of AI tools in cybercrime and the challenges they pose for financial institutions and cybersecurity teams.
The cybersecurity firm said the campaign was active from late September to early October 2026 and targeted multiple South Korean financial organisations. CrowdStrike assessed with moderate confidence that the threat actor was likely Chinese-speaking and financially motivated, but said the activity was not attributed to a named group.
According to CrowdStrike, the attacker used ARTEX, an open-source agentic penetration-testing tool developed in China, alongside large language models (LLMs). The firm identified Claude Code session histories, ARTEX configuration files and other data on infrastructure linked to the campaign.
CrowdStrike said the ARTEX setup primarily used DeepSeek v4.1-flash as its AI model backend, while other sessions involved GLM-5.3 from Zhipu AI and Grok 4.6. The tools were used alongside conventional offensive techniques during the attacks.
The investigation also found evidence suggesting a possible financial motive. CrowdStrike said the operator used Claude to seek information about where stolen Korean data could be sold and looked for Korean- language Telegram groups involved in data trading.
The campaign comes amid a series of cyber incidents affecting South Korean financial institutions. Shinhan Bank has reported the compromise of personal information belonging to about 25,000 customers, while KB Kookmin Bank disclosed a separate leak involving 119 customers. South Korean authorities are investigating the incidents.
The findings highlight concerns over the growing use of agentic AI in cyber operations. CrowdStrike said the combination of AI-powered tools and traditional attack techniques could enable threat actors to conduct intrusions more efficiently.
The incidents have added to concerns over the potential use of AI tools in cybercrime and the challenges they pose for financial institutions and cybersecurity teams.
