Hackers use AI to attack South Korean banks and steal data
CrowdStrike researchers have uncovered a series of cyberattacks targeting South Korean financial institutions in which hackers used artificial intelligence tools to steal data. The attackers deployed ARTEX, a Chinese-developed system designed to automate vulnerability discovery and exploitation.
According to the company's report, the attacks took place from late September to early October 2026. Researchers discovered attacker-controlled servers with open directories containing Claude Code session histories, ARTEX configuration files, and AI assistant memory files.
Analysis of these materials allowed investigators to reconstruct some attackers' activities and identify the infrastructure they used. CrowdStrike believes the operations were carried out by a financially motivated, Chinese-speaking threat actor, although the individual's identity remains unknown.
AI tools used to attack banking systems
According to industry reports, attackers gained access to a loan application status verification service used by financial intermediaries at one affected bank. In another incident, an employee support system for mobile devices was compromised.
Infrastructure analysis revealed two main servers. One, located in Hong Kong, was used to manage operations, while the other ran ARTEX during attacks against South Korean organizations.
The system used DeepSeek v4.1-flash as its primary language model. The attacker also accessed Zhipu AI's GLM-5.3 and Grok 4.6 through Claude Code.
The preserved sessions also contained queries about platforms where stolen South Korean data could be sold. In particular, the attacker searched for relevant Telegram groups and ways to find potential buyers.
Some records contained personal information potentially linked to the attacker, including a region of residence in China and contact details. However, CrowdStrike stressed that it could not reliably establish whether this information actually belonged to the threat actor.
AI accelerates cyberattacks
CrowdStrike noted that combining autonomous AI tools with traditional hacking techniques allows attackers to conduct multiple operations within a short period. However, the exact number of South Korean financial institutions affected remains unknown.
The growing capabilities of attackers are particularly concerning amid rising cybercrime losses in the cryptocurrency industry. According to estimates from two blockchain security firms, hackers stole more than $766 million through hacks and vulnerability exploits in September 2026. This made it the industry's costliest month of the year so far.
Earlier, we reported that the NEAR Intents protocol lost approximately $3.8 million in a cyberattack. The project team fixed the vulnerability and pledged to fully reimburse affected users.
Latest South Korea News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
