Traces of an AI Hacking Tool Found in Attacks on South Korea's Financial Sector as Regulators Launch Emergency Review

On October 7, the security firm CrowdStrike published its analysis of hacking activity aimed at South Korean financial institutions. The report examines servers used in attacks that took place from late September into early October. CrowdStrike confirmed both a data exfiltration campaign and the servers behind it. For the claim that multiple financial institutions were breached, the report cites industry press coverage. It also said that ARTEX, a penetration testing tool that uses AI, was most likely deployed in the attacks.

What the AI actually did

The clues were sitting in a server folder the attacker had left exposed to the outside. There, CrowdStrike found an ARTEX configuration file and Claude Code conversation logs. In the setup that investigators examined, a server in Hong Kong served as the main staging point for the attacks, while a separate server ran ARTEX. The configuration file and the conversation logs became the basis for understanding how the attacks were carried out.

ARTEX is a tool that takes a designated target, hooks up an AI model, and goes looking for security vulnerabilities. In the configuration that was examined, DeepSeek v4.1-flash was set as the primary model. Other Claude Code logs also showed signs that GLM-5.3 and Grok 4.6 had been used. The report, however, does not quantify how much ARTEX improved the attacker’s success rate at breaking in, or how much the campaign cost to run.

Anyone can download and use the tool, but its permitted uses are narrow. ARTEX’s developer allows it only for learning and research purposes, on the user’s own machine, isolated from outside systems. Scanning or penetration-testing live online systems is not permitted.

Was this the work of one person?

CrowdStrike said the case illustrates how AI tools let a financially motivated attacker carry out multiple intrusions in a short span of time. It did not firmly establish whether a single individual carried out the attacks. The firm also described its confidence as moderate that the attacker was a Chinese speaker motivated by financial gain.

The attacker’s nationality and identity remain unconfirmed. CrowdStrike said the personal information left behind in the conversation logs cannot be taken as the actual attacker’s identity. It stopped short of naming any specific individual based solely on signs of Chinese-language use and the personal details found in the logs.

How much customer data was exposed?

For users in South Korea, the most immediate concern is the leak of customer data from financial institutions. Citing reporting by the Kyunghyang Shinmun newspaper, The Decoder said more than 25,000 customer records were taken from Shinhan Bank alone. CrowdStrike did not establish how many institutions were affected in total, or the full volume of data exposed.

The Financial Services Commission and the Financial Supervisory Service convened an emergency review meeting on October 4. They instructed the financial sector to audit externally facing connection points, user authentication and access controls. They also called for greater sharing of information about attacks and stronger consumer protection measures.

The case suggests that an AI tool built for security testing may have been used to hack financial institutions in South Korea. What remains to be confirmed is the true extent of the damage, what protections customers will receive, and exactly what role AI played in the attacks. Anyone who uses financial services in South Korea would do well to check whether their own data was caught up in the breach, and what protective measures are available to them.