CrowdStrike disclosed on October 7 that the suspected attacker behind recent South Korean bank breaches used Claude Code, Anthropic's AI coding assistant, to inquire where breach data could be sold. The security firm uncovered the request in session logs stored in open directories on servers controlled by the attacker.
Scope of the Breaches
Multiple South Korean financial institutions disclosed customer data leaks between late September and early October. Shinhan Bank confirmed its breach on September 30, affecting approximately 25,000 customers who had accessed a mobile service used by loan agents. KB Kookmin Bank disclosed on October 2 that 119 customers were impacted through a mobile system used by employees. Hana Bank reported 89 affected customers, and BNK disclosed records on 11 outsourced workers.
The exposed data included names, phone numbers, annual income, and calculated loan limits. Shinhan Bank's breach also included 66 resident registration numbers, South Korea's national ID numbers.
AI Tools Used in the Campaign
CrowdStrike found that the attacker operated using ARTEX, an open-source penetration testing tool developed in China. The attacker's infrastructure was hosted on a Hong Kong-based server. According to CrowdStrike's analysis, the ARTEX instance used DeepSeek v4.1-flash as its primary AI model, with the attacker also employing Zhipu AI's GLM-5.3 and xAI's Grok 4.6 in other Claude Code sessions.
Evidence from Open Directories
Open directories on the attacker's servers contained Claude Code session histories, ARTEX configuration files, and Claude memory files. Beyond inquiries about selling Korean breach data, the attacker also sought help finding Korean Telegram groups involved in selling such information.
In another session, the user requested that Claude write a security researcher résumé featuring ARTEX results. The prompt included a Telegram handle, listed an age of 26, and specified a location in Maoming, Guangdong. The same Telegram handle appeared in Claude Code sessions probing a Telegram-based NFT gift marketplace.
Attacker Profile
CrowdStrike assessed with moderate confidence that the threat actor is financially motivated and likely a Chinese speaker, based on ARTEX usage and Chinese-language prompts. The security firm noted that while the details in the résumé request likely belong to the attacker, they cannot be definitively linked. CrowdStrike has not attributed the campaign to any named adversary group.
Official Response
President Lee Jae Myung raised concerns about AI involvement in hacking incidents during a Cabinet meeting. South Korean police subsequently opened a full-scale investigation into the breaches.
Broader Implications
CrowdStrike noted that AI tools can enable financially motivated actors to execute multiple intrusions rapidly. The firm expects attackers to continue experimenting with AI tools and was among over 100 companies that signed an August letter warning of surging AI-enabled cyberattacks.
