China-based suspect used AI tools in South Korean bank hacks, says CrowdStrike

A 26-year-old suspect from China's Guangdong province may have used AI tools to carry out cyberattacks on South Korean financial institutions, according to security firm CrowdStrike. The attacks, which took place from late September to early October, involved Chinese-developed AI agent tool ARTEX and Anthropic's ClaudeCode. CrowdStrike uncovered personal details linked to the suspected attacker while analyzing AI coding-tool sessions and related infrastructure.

The attacker likely used ARTEX, a recently released open-source penetration testing tool published on GitHub by a Chinese security engineer, alongside large language models like Claude. The individual reportedly asked Claude about the sale of Korean data breach information and sought assistance in finding Korean Telegram data sales groups.

The incident has heightened concerns over the use of AI agents in cyberattacks and whether organizations are adequately prepared to defend against them. At least nine South Korean banks have reported cyberattacks since late September, leading to a police investigation and a call for robust response measures from President Lee Jae Myung.