Chinese-speaking hacker leverages AI tools to breach South Korean banks
A hacker believed to speak Chinese used AI-driven tools to infiltrate several South Korean banks, stealing data and prompting investigations.
CrowdStrike disclosed that an unknown hacker, likely a Chinese speaker, used AI-powered hacking utilities to target multiple South Korean financial institutions between late September and early October. The attacker combined the China-developed open-source tool ARTEX with large language models, including DeepSeek v4.1-flash, GLM-5.3 and Grok 4.6, to breach Hana Bank, KB Kookmin Bank and Shinhan Bank. Compromised assets included a loan inquiry service used by brokers and a mobile work-support system for bank employees.
Two servers were identified: one in Hong Kong serving as the main command node and another hosting ARTEX, presumably used against the banks. While the hacker’s identity and the total data loss are unverified, analysis of chat logs shows a financial motive, with queries about selling stolen South Korean data on Telegram. Authorities have launched investigations into the incidents.
Why it matters
AI-enabled cyberattacks on banks raise new security challenges and threaten sensitive financial data.
How this story developed
- Oct 4 President Lee orders full inquiry into recent bank data breach incidents
- Oct 5 Regulators have ordered banks to block non‑essential external connections and carry out emergency security audits.
- Oct 6 President Lee ordered allocation of manpower and budget for response as police opened a cyber‑crime investigation.
In this story
Related stories
5 in this thread