The cybersecurity firm CrowdStrike has published evidence linking recent cyber attacks on South Korean financial institutions to a lone Chinese hacker using AI tools.

The attacks took place from late September to early October and saw Hana Bank, KB Kookmin Bank, Shinhan Bank and at least six others affected, according to local media reports.

The New York Times separately reported at least 25,000 customer credit records were stolen at Shinhan Bank alone.

CrowdStrike’s investigation into the threat campaign found the attacker used ARTEX, a Chinese-developed, open-source penetration testing tool that connects to large language models to carry out autonomous hacking.

The researchers linked the attacker’s IP address to ARTEX configuration files and session histories for Anthropic’s Claude Code, as well as a markdown document containing a Chinese language prompt.

Within the prompt history, CrowdStrike found evidence of the hacker asking Claude to help them find a good site to sell breached South Korean data and where to find South Korean data breach Telegram groups.

In another session, the hacker asked Claude to create a security researcher resume for them. In the prompt, they listed their age as 26, their location as Maoming in Guangdong, China and gave a phone number.

Reuters reached a man on the phone number CrowdStrike listed, who said he had no knowledge of the incidents.

The South Korean Prime Minister Han Seong-sook called for a major update to cybersecurity systems in response to the attacks.

“Government agencies, public institutions, the financial sector and private enterprises should all remain vigilant, and they should take this incident as an opportunity to swiftly resolve the issue and completely overhaul our security systems,” Han said, as reported by Yonhap News Agency.

The publication added that South Korea's Financial Supervisory Service has identified 28 IP addresses linked to the attacks. These originated in US, Japan, Germany and at least ten other countries, making attribution of the attackers difficult.

---