artex

At the end of September and the beginning of October, at least seven financial institutions in South Korea experienced data breaches, including Shinhan Bank, Kookmin Bank, and Hana Bank. Approximately 25,000 customers of Shinhan Bank and about 40,000 customers of Yegaram Savings Bank were affected, with leaked information including names, phone numbers, annual income, and loan limits; no theft of funds has been discovered so far.The attacks primarily targeted loan inquiry services used by loan intermediaries and peripheral banking systems such as employee mobile office systems. Multiple attacks involved overlapping IP addresses, leading South Korean regulatory authorities to suspect they were carried out by the same attacker. On October 6, South Korean President Yoon Suk-yeol stated that these attacks may have utilized AI.On October 7, CrowdStrike reported that the attackers controlled the attack using a server located in Hong Kong, with another running the open-source AI penetration testing system ARTEX. Investigators obtained the ARTEX configuration files, Claude Code chat records, and AI memory files. The configuration indicated that the attackers primarily used DeepSeek v4.1-flash to drive ARTEX, also utilized Claude Code, and had previously called GLM-5.3 and Grok 4.6 in other sessions. The chat records showed that the attackers inquired about channels for selling the leaked data in South Korea and related Telegram trading groups, and instructed the AI to draft a resume for a security researcher that included information such as 26 years old, Maoming, Guangdong, South China University of Technology, and contact details, but the birth date did not match the age. CrowdStrike assessed that the attackers might be using Chinese and aimed for profit, but their true identity has not yet been confirmed.