South Korea, 26-year-old hacks nine banks with the help of artificial intelligence

A 26-year-old, who is said to live in China and uses artificial intelligence tools, may be behind the recent cyberattacks on South Korean banks, according to the U.S. cybersecurity firm CrowdStrike.

The suspect allegedly used an artificial intelligence (AI) agent developed in China, as well as Anthropic’s Claude Code, to carry out attacks on financial institutions.

According to a report published by CrowdStrike on Wednesday, analysis of digital traces and sessions carried out with AI programming tools led researchers to assess that the suspect is likely to be in China’s Guangdong province.

At least nine South Korean banks have reported cyberattacks or have been named as targets in local media reports since late September. The attacks prompted the country’s police to launch an investigation this week, while South Korean President Lee Jae-myung called for strong countermeasures.

How one person can attack multiple targets with the help of artificial intelligence

The case highlights the new risks posed by the use of autonomous artificial intelligence systems in cyberattacks.

Adam Myers, senior vice president of cyber threat operations at CrowdStrike, explained in a telephone conference with journalists on Thursday that this is a typical example of a lone actor using artificial intelligence agents to carry out attacks on a large scale. “This is important because it allows one person to target many clients in a very short period of time, exploiting the power of artificial intelligence,” he said.

The findings are expected to raise concerns about how well prepared businesses and organisations are to protect their systems from attacks using such tools. Shinhan Bank announced last week that the personal data of around 25,000 of its clients had been compromised, while KB Kookmin Bank reported a leak of the personal information of 119 of its clients.

The CV he asked Claude for, and the traces he left behind

One of CrowdStrike’s most interesting findings concerns how researchers were able to identify the possible perpetrator. While analysing the sessions with Claude, they discovered that the suspect had asked the tool for information about platforms on which cybercriminals commonly sell stolen data from South Korea.

He also asked for help identifying Telegram groups where Korean data was traded. In a separate session, the user asked Claude to create a CV for a cybersecurity researcher. The CV included information such as a Telegram account, his age, educational background and residence in the city of Maoming, in southern China’s Guangdong Province.

CrowdStrike believes the data is likely to belong to the suspect behind the attacks. However, his identity has not been confirmed. In fact, a man who answered a telephone number made public in the company’s report said he knew nothing about the case.

Use of a Chinese tool and Beijing’s response

According to CrowdStrike, the attacker used ARTEX, a recently developed open-source tool in China designed for automated auditing of computer systems’ security, and combined it with large language models (LLMs), such as Anthropic’s Claude.

“While this activity has not been attributed to a specific, identified perpetrator, the threat actor is likely to speak Chinese and is financially motivated,” the report states.

The company clarifies that its assessment is formulated with a moderate degree of confidence and is based mainly on the use of the Chinese-developed ARTEX and the presence of instructions written in Chinese.

For Beijing’s part, Chinese Foreign Ministry spokeswoman Mao Ning said during a regular briefing with journalists that the ministry was not aware of the specific case. She added that China firmly opposes, in principle, cyber hacking activities and combats them.

Anthropic and the South Korean police did not respond to Reuters’ requests for comment.