Suspect behind South Korea bank hacks may be 26-year-old in China: Crowdstrike

Crowdstrike said the threat actor was likely a Chinese speaker and financially motivated.

PHOTO ILLUSTRATION: LIANHE ZAOBAO

CrowdStrike said a suspect behind South Korea’s bank hacks may be a 26-year-old in Guangdong, China, but it said the identification is not certain.

The firm linked the attacks to AI coding tools, ARTEX and Claude Code, and said the actor may be Chinese-speaking and financially motivated.

Seoul is investigating breaches at banks including Shinhan Bank and KB Kookmin Bank, while President Lee Jae Myung has urged stronger cybersecurity after signs of AI use.

SEOUL – The suspect behind recent cyberattacks targeting South Korea’s financial sector may be a 26-year-old based in China’s Guangdong province, US cybersecurity firm CrowdStrike said.

In a report published on its website on Oct 7 , CrowdStrike said it uncovered personal details linked to the suspected attacker while analysing artificial intelligence coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October.

The case is likely to intensify concerns over the rise of AI agents and whether organisations are prepared to defend their systems against them.

Australia said in September that an OpenAI autonomous agent breached a government health statistics portal in June , marking one of the first known instances of an AI agent hacking a government system.

CrowdStrike said the attacker used ARTEX, a recently released Chinese-developed open-source penetration testing tool, alongside large language models (LLM) such as Claude.

“While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” it said.

“This assessment is made with moderate confidence based on the use of the Chinese-developed tool ARTEX and observed Chinese-language prompts.”

CrowdStrike said the individual also asked Claude where threat actors typically sell Korean data breach information and sought assistance in finding Korean Telegram data sales groups.

In another session, the person also requested Claude to create a security researcher resume , which included details such as a Telegram account, age, educational background and a location in Maoming, a city in the southern Chinese province of Guangdong, which CrowdStrike said likely belonged to the attacker.

A man who answered a phone number provided by CrowdStrike in its report said he had no knowledge of the matter.

Anthropic, the South Korean police and China’s Foreign Ministry did not immediately respond to requests for .

ARTEX is an open-source AI agent for automated penetration testing that was published on GitHub in 2026 by a Chinese security engineer with the handle Autumn. It is not a standalone large language model but connects to external LLMs such as ChatGPT, Claude and DeepSeek to help organisations test for vulnerabilities in the networks.

The tool’s GitHub page says it is intended for personal learning, code research and local technical verification and should not be used to conduct real-world testing against online systems or websites.

At least nine South Korean banks have disclosed or been reported by the local media as having been targeted by cyberattacks since late September, prompting the South Korean police to launch a probe this week and President Lee Jae Myung to call for robust response measures.

Shinhan Bank said last week that personal information of 25,000 of its customers was compromised, while KB Kookmin Bank said that the personal information of 119 of its customers was leaked. REUTERS

Banks and financial institutions

AI/artificial intelligence