Photo: Collected
US cybersecurity firm CrowdStrike suspects that a 26-year-old young man based in China’s Guangdong province may be involved behind the recent cyberattacks on several financial institutions in South Korea.
The firm claims the attacker broke into the systems of banks and financial institutions using an artificial intelligence or AI-based cyber tool made in China and various large language models. However, the identity of the person has not yet been confirmed.
According to a Reuters report, a series of cyberattacks targeting South Korea’s financial sector was carried out from late September to early October. CrowdStrike said it found some clues to the suspect’s personal information by analysing the infrastructure used in these attacks and the sessions of AI coding tools.
An open-source agentic penetration testing tool made in China named ARTEX has come to the notice of investigators. Large language models were also used with it. CrowdStrike says that considering the pattern of the attack, the instructions given in the Chinese language and the technology used, the attacker is likely to be a Chinese speaker. At the same time, it assesses with ‘moderate confidence’ that the attack may have been carried out for financial gain.
Technical analysis also showed that DeepSeek’s V4.1-Flash model was used behind ARTEX. In some separate sessions, CrowdStrike also detected the use of China’s Zhipu AI’s GLM-5.3 and Grok 4.6. That is, the attacker did not rely on just one AI system, but made use of multiple models and coding environments.
An important clue about the suspect’s identity was found in a session of Anthropic’s Claude Code. There, a user asked the AI to prepare a cybersecurity researcher’s curriculum vitae for himself. That instruction contained information such as an age of 26, an educational institution, a Telegram account and a location in the city of Maoming in China’s Guangdong.
CrowdStrike said the same Telegram username was also found in some other cyber activities. These include research on security vulnerabilities of a Telegram-based NFT marketplace and information on a possible attack on a Chinese payment platform. Although these clues indicate links between the suspect and various activities, evidence sufficient to confirm his identity has not yet been found.
Some clues have also been found about the motive for the attack. According to CrowdStrike’s analysis, the person had asked Claude where stolen South Korean data is usually sold and how Telegram groups selling such data can be found. This has further strengthened the likelihood of a financial motive behind the attack.
Authorities are investigating recent incidents of data leaks at several financial institutions in South Korea. The names of several institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank, have come up in this investigation. Among the attacks mentioned in CrowdStrike’s analysis, there is information that one bank’s loan-related information inquiry service and another institution’s mobile work-support system for employees were affected.
According to a Yonhap report, the attacker used a Hong Kong-based server as the main control infrastructure. ARTEX was being run on another server, which is believed to have been used to target South Korean financial institutions. An attempt was also made to conceal the path of the attack by using multiple IP addresses.
A major cause for concern over the incident is that this time AI was not used merely as an aid for writing or generating code; evidence has been found of AI-powered agents being put to use at various stages of a cyberattack. CrowdStrike says that using such technology, a single attacker is able to attempt intrusion into multiple institutions within a short time. The firm also fears that cybercriminals will further increase their use of AI in the future.
South Korean President Lee Jae-myung had also said that signs of AI use were found in some of the recent bank hacking incidents. He called for further strengthening the country’s cybersecurity system.
However, the investigation is still at an early stage. Final information on the identity of the person linked to the attack, how many institutions in total were affected and how much data was stolen is not yet confirmed. As a result, the time has not yet come to conclude that the 26-year-old young man is the person behind the attack.
Even so, the incident makes a new reality clear – AI agents are now becoming a real operational tool even in complex cybercrimes such as bank hacking. So the big future challenge before financial institutions is not only to stop skilled hackers, but also to repel fast and automated AI-powered attacks.
