Full Breakdown
AI-Powered Intrusion Campaign Targets South Korean Banks
By Drooid · · How we work
Core Event
In late September 2026, cyberattacks hit at least nine South Korean banks. CrowdStrike’s Oct 7 report linked the campaign to a 26-year-old individual in Guangdong, China. The attacker used the open-source tool ARTEX and LLM agents including Anthropic’s Claude Code, DeepSeek, GLM-5.3 and Grok 4.6, accessing a loan-inquiry service at one bank and an employee mobile-work system at another, exfiltrating personal data.
Background & Context
South Korea’s banking sector has seen a wave of breaches since September, prompting a police investigation and a call for a “robust response” from President Lee Jae Myung. The attacks follow heightened scrutiny of AI agents after an OpenAI system breached an Australian health portal in June 2026, raising questions about current cyber-defense and insurance frameworks.
Key Tools and Methods
- ARTEX: An open-source AI agent for automated penetration testing, published on GitHub in 2026 by a Chinese engineer using the handle “Autumn.”
- Claude Code and other LLMs: Used to run Chinese-language prompts that performed vulnerability scans, located data-sale marketplaces on Telegram, and drafted a “security researcher” résumé containing personal details.
- Infrastructure: CrowdStrike identified two servers—one in Hong Kong and another at IP 38.244.50[.]120 hosting the ARTEX instance. Open directories on these servers held Claude session histories and configuration data, revealing the attacker’s workflow.
Data Breaches and Impact
- Shinhan Bank: Personal information of roughly 25,000 customers was compromised via a loan-broker inquiry service.
- KB Kookmin Bank: A leak affected 119 customer records from an employee work-support system.
- Additional banks were mentioned in local media, but the total number of affected institutions and the full scope of stolen data remain unconfirmed.
Official Statements & Responses
- President Lee Jae Myung called for a robust response, noting AI-model involvement and “considerable public concern.”
- South Korean police declined comment while the investigation continues.
- Anthropic and the police did not respond to requests for comment.
Conflicting Reports & Gaps
- Sources agree the attacker used ARTEX and Claude Code, but the individual’s identity is unverified.
- The “at least nine” banks figure is cited by several outlets; a precise count of affected institutions and data volume has not been disclosed.
- Some reports note overlapping IP addresses across incidents, suggesting shared infrastructure, though coordination details are unclear.
What’s Next
CrowdStrike warned that adversaries will likely keep experimenting with AI-driven tools. South Korean authorities have opened a police probe and the president has urged stronger defensive measures, but no timeline for remediation or regulatory action has been announced.