Hacker used Claude AI agents and a Chinese pen-test tool to breach Korean banks
CrowdStrike traced October attacks on Shinhan, KB Kookmin, and Hana banks to a lone hacker running AI agents on autopilot — who then used the same tools to write a résumé that gave away his identity.
What happened: Cyberattacks hit several major South Korean banks this month, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. Attackers exposed customers' personal data and credit card details, and some bank systems went down. Seoul's government called an emergency meeting and pushed for immediate security upgrades at critical financial institutions. Security firm CrowdStrike has now identified how it was done: a single Chinese-speaking hacker using an AI-driven hacking toolkit called ARTEX, paired with Anthropic's Claude AI coding agents, to automate much of the break-in.
Why it matters: This isn't a nation-state team with years of planning. CrowdStrike's investigation suggests one person leaned on off-the-shelf AI agents to do reconnaissance, writing, and decision-making that used to require a skilled crew. That lowers the bar for who can pull off a damaging bank breach. It also shows how quickly an open-source AI tool built for legitimate security testing can be turned into an attack weapon once it leaks out, and how hard it is to put that genie back once copies spread.
How it works, plainly: ARTEX is an agentic penetration-testing suite, originally open-source and built in China, designed to automate the steps of probing and exploiting computer systems. The attacker ran it using DeepSeek's v4.1-flash model as the main engine, backed up by other Chinese AI models (GLM-5.3) and xAI's Grok, accessed through a third-party API reseller. He also ran separate Claude Code sessions for additional tasks. Researchers found an open, unsecured directory on the attacker's own infrastructure containing his Claude chat logs, ARTEX settings, and AI memory files, which let CrowdStrike reconstruct what he did and tie it to the bank breaches with high confidence.
The rollout: The sloppiest part: the hacker used the same AI tools to draft a résumé, which leaked his name, contact details, and Telegram handle. CrowdStrike believes he may be a 26-year-old from Maoming, China, who studied at South China University of Technology, though an inconsistent birth date means the identification isn't fully confirmed. Chat logs show he had no real plan to sell the stolen bank data and asked Claude to suggest Telegram marketplaces for it. After learning ARTEX had been used in a real attack, its developer took the project closed-source and stopped updating it, but copies and English/Korean spinoffs are already circulating online.