One hacker with a free AI attack tool got into South Korean banks, and went in through the side doors
CrowdStrike says a single financially motivated hacker, probably working from southern China, used an open-source AI attack agent and several commercial models to break into South Korean banks in a matter of days. The weak points were support systems for brokers and staff, which most companies guard less carefully than their core.
A single hacker, probably based in southern China, used an AI attack agent to break into several South Korean banks in a few days, according to a CrowdStrike Intelligence report published on 7 October. The campaign ran from late September into early October. CrowdStrike says the attacker mainly used ARTEX, an open-source “agentic penetration testing” tool developed in China, with DeepSeek as its main model and Anthropic’s Claude Code, Zhipu’s GLM and xAI’s Grok alongside it. Its conclusion is that AI tooling let one financially motivated person carry out several intrusions in a short time.
At least nine South Korean banks have disclosed attacks or been reported as targets since late September, Reuters reports. Shinhan Bank says about 25,000 customers’ personal data was taken, and KB Kookmin Bank 119. Across the affected firms, the exposed data covers more than 67,000 people, according to The Korea Times, including names, phone numbers, annual income and loan limits.
How the attacker got into the South Korean banks
The attacker went for the edges of the banks, away from the core banking systems. At one bank it was a loan progress service used by outside brokers, at another an app staff use for mobile work support, CrowdStrike says. Hana Bank’s smaller breach came through a sales support system, BleepingComputer reported. Hwang Suk-jin of Dongguk University told The Korea Times that going through these weaker supporting networks is also what kept the damage limited.
ARTEX is built to scan systems for weaknesses, map routes in and plan the attack, and it plugs into whatever language model the user connects. Its author, a Chinese security engineer, posted it on GitHub this year with a note that it is for learning and not for use against live systems. That note did not stop anyone. The Korean security firm AhnLab found ARTEX running on about 600 servers worldwide, Yonhap reported on 6 October, though that counts installations, not attacks.
CrowdStrike tied the campaign to one server hosting an ARTEX instance and a second in Hong Kong that held open directories. Those contained Claude Code session histories, configuration files and a Chinese-language prompt telling the model how to run a penetration test. The attacker also asked Claude where stolen Korean bank data is usually sold and for help finding Korean Telegram groups that buy it. One session included a Telegram username and a location in Maoming, in Guangdong province, which CrowdStrike thinks belong to the attacker. Anthropic did not respond to Reuters’ request for comment.
Why this case is different from earlier AI hacking stories
Earlier incidents on this blog were about AI labs losing control of their own systems, such as OpenAI’s agents breaking into Hugging Face during a test. This one is ordinary crime done faster. A person chose the target, wanted money and used AI to multiply what one person can do. CrowdStrike’s Adam Meyers put it as one human able to target many customers in a very short period.
The model mix matters too. The attacker ran Claude Code, Anthropic’s coding agent, partly with other companies’ models plugged in. Whatever safeguards one lab builds into its own model, the tooling around it is portable, and an attacker can route the work to whichever model refuses least. That is a problem for the voluntary approach in the White House safety pact, which relies on each lab policing its own products.
What the evidence does and does not show
The evidence is strong on tooling and weaker on everything else. CrowdStrike’s attribution is at “moderate confidence”, it has not linked the attacker to any known group, and it says the total number of victims is unconfirmed. China’s foreign ministry said it was not familiar with the case and opposes hacking.
Lim Jong-in of Korea University told The Korea Times that some Chinese models have weak safeguards and can be downloaded and modified by anyone, so the tool’s origin does not show who used it. A summary of the Korean reporting by Runtime Wire adds a further caution: nothing published so far proves the agent carried out the intrusions on its own or made the decisions. Credential stuffing, trying leaked passwords at scale, is among the suspected techniques, and that is decades old.
The reading that fits the evidence is narrower than the headlines. AI made an old kind of attack cheaper and gave one person the reach that used to need a team. For defenders, that is enough to change the arithmetic.
Why European banks and their suppliers should pay attention
South Korea’s Financial Services Commission held an emergency meeting on 5 October and told financial companies to inspect every externally reachable system, including ones customers never see, and to check for missing authentication and access controls, BleepingComputer reports. That instruction would fit a European bank word for word.
EU financial firms already work under the Digital Operational Resilience Act, which has applied since 17 January 2025 and requires them to report major ICT incidents. Outside finance, Denmark’s NIS2 law has required covered companies to manage cyber risk at board level and report serious incidents within 24 hours since July 2025. Neither law cares whether the attacker used AI. Both assume you know which of your systems face the internet, and the Korean banks show how easily the portal for brokers or the staff app falls off that list.
The defensive side has AI too. Google gave its Gemini 4 Argon model to cyber defenders first, and Anthropic is keeping its vulnerability-finding Mythos model inside a closed programme. Most European companies are not in those programmes, which means the attackers’ tools are currently easier to get than the defenders’.
What to check this month
Start with an inventory of everything reachable from the internet, then sort it by how much attention it gets. The broker portals, partner logins, staff mobile apps and old test systems at the bottom of that list are where this attacker went in. Each one needs an owner who knows it exists.
Put multi-factor authentication on every external login, including the ones for partners and contractors, and watch for credential stuffing: many failed logins from many addresses against one service. That single control would have blunted the technique investigators suspect here.
Assume scanning is now continuous. If an attacker with a free tool can probe hundreds of services a day, a vulnerability that sits unpatched for a month on an exposed server will be found. Shorten patch times for anything external, and run your own automated scans so you see what they see.
Finally, ask your IT and security suppliers a direct question: do they use AI-driven testing on your systems, and how often? If the answer is no, the only people running AI against your systems are the attackers.
