What changed
CrowdStrike says the suspect behind cyberattacks on South Korean financial institutions may be a 26-year-old based in Guangdong, China. The campaign ran from late September to early October and affected banks including Shinhan Bank and KB Kookmin Bank, which reported data breaches.
Why it matters
The unusual detail is how the suspect was traced: through AI coding-tool sessions and related infrastructure. One Claude Code session reportedly asked for a security researcher résumé describing the hacking work, including a Telegram account, age, education and location in Maoming.
CrowdStrike assessed with moderate confidence that the actor was Chinese-speaking and likely financially motivated. The activity involved ARTEX, a recently released Chinese-developed open-source penetration-testing tool, alongside large language models. South Korean police are investigating, while the identity remains unconfirmed.
That uncertainty matters. A Telegram username linked to the suspected actor also appeared in vulnerability research involving a Telegram-based NFT marketplace and in a separate suspected attack on a Chinese payment platform. Those links may strengthen the case, but they do not by themselves prove who carried out the bank attacks.
South Korean President Lee Jae Myung has said signs of AI use emerged in some of the incidents and called for stronger cybersecurity measures. The immediate question is no longer simply whether financial institutions were breached, but how investigators distinguish genuine evidence of AI-assisted activity from traces left by the person operating it.
Comments
No comments yet.