Products You May Like
US cybersecurity firm CrowdStrike has linked a series of artificial intelligence-assisted cyberattacks against South Korean financial institutions to a possible suspect in China, raising fresh concerns about the growing use of autonomous AI tools in financial crime.
CrowdStrike said digital records associated with the attacks suggest the individual responsible may be a 26-year-old based in China’s Guangdong province, although the company has not established the suspect’s identity.
The findings follow a wave of cyberattacks targeting at least nine South Korean banks since late September, with several institutions reporting breaches involving customer information.
CrowdStrike said the attacker used ARTEX, a Chinese-developed AI penetration-testing platform, with DeepSeek as its primary language model. Investigators also uncovered Claude Code sessions and other digital records that provided insight into the campaign.
The investigation provides an unusually detailed picture of how commercially available AI technology can be adapted for malicious activity, potentially allowing individuals to conduct increasingly sophisticated attacks with fewer technical resources.
For banking executives, the incident highlights a growing challenge: protecting sensitive financial systems against threats that can use artificial intelligence to identify vulnerabilities and automate parts of an attack.
How AI Tools Were Used in the Bank Attacks
CrowdStrike’s investigation uncovered AI coding sessions, configuration files and other digital records associated with infrastructure used in the attacks.
Researchers identified ARTEX, an open-source penetration-testing platform developed in China that uses AI agents to help automate security assessments.
Although the software was designed for legitimate cybersecurity testing, CrowdStrike said the suspected attacker appeared to have deployed it against financial institutions.
DeepSeek was identified as the primary AI model supporting the ARTEX deployment, while researchers also discovered separate Claude Code sessions that provided further evidence about the individual’s activities.
Researchers uncovered conversations in which the individual sought information about markets for stolen South Korean data and Telegram groups associated with trading compromised information.
In another session, the individual asked Claude to prepare a cybersecurity researcher résumé containing personal information, including an age of 26, educational details and a location in Maoming, Guangdong province.
CrowdStrike said those details may belong to the person responsible for the attacks, but stressed that the available evidence does not establish a definitive identity.
The company assessed with moderate confidence that the attacker was a Chinese speaker and financially motivated.
Importantly, the findings do not establish any connection between the attacks and the Chinese government. China’s foreign ministry said it was unfamiliar with the case and reiterated the country’s opposition to hacking.
South Korean Banks Report Customer Data Breaches
The investigation comes as South Korean authorities examine a series of security incidents affecting the country’s financial sector.
At least nine banks have reportedly been targeted since late September, although that does not mean all nine suffered successful data breaches.
Shinhan Bank confirmed that personal information belonging to approximately 25,000 customers had been compromised.
KB Kookmin Bank separately reported that information relating to 119 customers had been exposed, while Hana Bank reported a breach affecting 89 customers.
Other financial institutions have also reported incidents, prompting police investigations and an emergency response from financial regulators.
South Korean President Lee Jae Myung warned earlier this week that artificial intelligence appeared to have been used in some of the attacks and called for stronger cybersecurity measures capable of responding to increasingly sophisticated AI-enabled threats.
According to CrowdStrike, reported breaches involved systems including a loan application enquiry service used by financial brokers and an employee mobile support platform, highlighting vulnerabilities in systems connected to banking operations.
That distinction matters for executives overseeing large financial organisations, where external service providers, employee platforms and customer-facing applications can create vulnerabilities beyond the most heavily protected core banking systems.
AI-Powered Cyberattacks Create New Risks for Business Leaders
The South Korean incidents illustrate how artificial intelligence is changing the economics and potential scale of cybercrime.
Traditional cyberattacks can require considerable technical expertise, preparation and specialised software. AI-powered tools can potentially reduce those barriers by helping attackers identify weaknesses, analyse systems and automate elements of their operations.
Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, said the incident demonstrated how AI agents can allow a single individual to conduct attacks against numerous targets in a relatively short period.
For businesses, that raises concerns not only about the sophistication of future attacks but also the speed and scale at which cyber threats can develop.
ARTEX itself is not inherently malicious. Like other penetration-testing technologies, it was developed to help security professionals identify vulnerabilities before criminals can exploit them.
However, the same capabilities can be misused when deployed against systems without authorisation.
The emergence of AI-assisted attacks is also creating uncertainty for cyber insurers. Questions are emerging over whether existing policies adequately cover incidents involving autonomous AI agents and how responsibility should be assigned when automated systems contribute to financial losses.
For companies, that creates a difficult security environment in which technologies designed to improve productivity and automate complex tasks can also expand the capabilities available to cybercriminals. The growing adoption of AI-generated software is also creating additional cybersecurity and compliance risks for businesses.
The implications extend well beyond banks. Businesses in healthcare, insurance, retail and other industries increasingly depend on interconnected digital systems containing sensitive customer information.
Cybersecurity is consequently becoming an increasingly important boardroom issue rather than simply a responsibility delegated to IT departments, with enterprise security investment increasingly viewed as a strategic priority for CEOs and boards.
Why the CrowdStrike Findings Matter
The investigation also demonstrates how AI systems can leave behind valuable evidence.
CrowdStrike researchers were able to reconstruct aspects of the suspected attacker’s activities by examining exposed coding sessions, configuration files and other digital records. Those traces helped investigators understand the tools involved and identify possible clues about the individual operating them.
Nevertheless, the company has not conclusively identified the attacker, and the full scope of the South Korean incidents remains under investigation.
For CEOs and boards, the wider lesson is that cybersecurity strategies must evolve alongside the technology creating these new risks. Establishing effective AI governance frameworks is becoming increasingly important as businesses confront new questions about accountability, security and operational resilience.
As AI makes increasingly complex tasks easier to automate, the ability of a single attacker to operate at greater speed and scale could fundamentally alter the cyber threat facing businesses — and make resilience against AI-assisted attacks an increasingly important corporate priority.