AI tools identified as part of cyberattacks on South Korean banks

A U.S. cybersecurity firm has identified a possible suspect behind recent cyberattacks on South Korea's financial sector, according to Reuters. The suspect may be a 26-year-old individual residing in China's Guangdong province, as reported by CrowdStrike in a website post on Wednesday. The firm uncovered personal details linked to the attacker while examining AI-powered coding-tool sessions and infrastructure related to a campaign targeting South Korean financial institutions between late September and early October.

CrowdStrike noted that the perpetrator utilized ARTEX, a recently released open-source penetration testing tool from China, alongside large language models and assessed with "moderate confidence" that the actor was likely Chinese-speaking and motivated financially. One Claude Code session included a request to generate a security researcher resume, which contained details such as a Telegram account, age, education background, and a location in Maoming, Guangdong, the report stated.

The same Telegram username appeared in other cyber activities, including vulnerability research involving a Telegram-based non-fungible token marketplace and a suspected attack on a Chinese payment platform. While CrowdStrike believes the personal details likely belong to the attacker, they cautioned that current information may not definitively identify the individual.

South Korean authorities are investigating multiple bank data breaches, including those affecting Shinhan Bank and KB Kookmin Bank. South Korean President Lee Jae Myung commented on Tuesday that signs indicated AI was used in some hacking incidents and called for stronger cybersecurity measures.