GoKawiilCrowdStrike links ARTEX AI and Claude tools to South Korean bank breaches
CrowdStrike reported that a Chinese-speaking hacker used the ARTEX AI penetration testing suite alongside Claude Code agents to attack major South Korean banks including Shinhan, KB Kookmin, and Hana, exposing customer personal and credit card data and causing outages at some institutions. Researchers found open directories containing Claude session histories and ARTEX configuration files that tied the attacker's infrastructure to the breaches and revealed identifying details from a résumé the attacker had generated with the same tools.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how open-source agentic AI tools built for penetration testing can be repurposed for real-world attacks on critical financial infrastructure, prompting South Korea's government to call an emergency meeting on IT security. The exposed operational files suggest attackers' own tooling and workflow mistakes can become a forensic goldmine for investigators, though CrowdStrike cautions that the personal details found, including a conflicting birth year, are not yet reliable enough to confirm the attacker's true identity.
- Attackers combined ARTEX AI with Claude Code agents and multiple LLM backends including DeepSeek, GLM-5.3, and Grok 4.6
- Breaches at Shinhan, KB Kookmin, and Hana banks exposed personal and credit card data and caused outages
- CrowdStrike found résumé and infrastructure clues pointing to a possible China-based individual, but identity remains unconfirmed
Source: bleepingcomputer.com, 2026-10-10
Published there as: “ARTEX AI, Claude agents used in cyberattacks on South Korean banks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.