CrowdStrike says China-based suspect used AI tools in South Korean bank hacks

SEOUL: A 26-year-old suspect from China's Guangdong province may have employed AI tools to carry out cyberattacks on South Korean banks, according to CrowdStrike's recent report. The firm discovered personal details connected to the suspected attacker during their investigation into AI coding-tool sessions and infrastructure involved in the campaigns targeting South Korean financial institutions from late September to early October.

This incident may fuel concerns about the increasing use of AI agents and their potential to breach organizational systems.

Anthropic's Claude and Chinese-developed ARTEX were used by the attacker in conjunction with large language models to conduct their attacks. While the threat actor's identity remains unattributed, CrowdStrike suspects they are a Chinese speaker and financially motivated. The individual reportedly asked Claude about the typical sale of Korean data breach information and inquired about finding Korean Telegram data sales groups.

The suspect also requested Claude to generate a security researcher resume, which included details like a Telegram account, age, educational background, and location in Maoming, a city in China's Guangdong province. A man who answered a phone number provided by CrowdStrike denied any knowledge of the matter.

Shinhan Bank reported that 25,000 of its customers' personal information was compromised, while KB Kookmin Bank's data of 119 customers was leaked. South Korean police have launched an investigation into the incidents, and President Lee Jae-myung has called for robust response measures.