Key points
- CrowdStrike says a campaign against South Korean financial organisations was active from late September to early October 2026 and resulted in exfiltrated data. [1]
- The company found Claude Code session histories, ARTEX configuration files and Claude memory files in infrastructure associated with the activity. [1]
- Reuters reports that breaches affected multiple financial institutions, including Shinhan Bank and KB Kookmin Bank; earlier reporting also named Hana and Woori banks. [2] [3] [4]
- CrowdStrike assessed with moderate confidence that the actor was likely Chinese-speaking and financially motivated, but did not name an adversary. [1]
- A possible Guangdong location and personal details in one AI-tool session are leads, not proof of the attacker’s identity, nationality, physical location or state affiliation. [1] [2]
What happened
The short answer is that South Korean banks and other financial organisations are investigating breaches reported from late September into early October, while the available evidence points to an AI-assisted campaign without proving who carried it out. CrowdStrike says it identified infrastructure associated with activity targeting South Korean financial organisations and that data was exfiltrated — meaning copied out of systems without authorisation. The report does not establish a final count of affected organisations. [1]
Reuters reported that Shinhan Bank and KB Kookmin Bank were among the institutions reporting breaches. Earlier Reuters accounts also said Hana Bank and Woori Bank had suffered incidents. South Korean authorities expanded on-site investigations after Shinhan reported a breach on September 30. [2] [3] [4]
Reuters reported that Hana said information involving 89 clients had leaked, including names, personal identification numbers and phone numbers, but not financial information. That detail belongs to the reported Hana incident and should not be treated as the impact across every institution named in coverage. The full amount and type of data involved elsewhere remain unclear. [3]
The response has been broader than an individual-bank inquiry. South Korean President Lee Jae Myung ordered a thorough investigation and response measures over personal-data leaks at banks, finance companies and public agencies. He said signs had emerged that AI was used in some hacking incidents and called for cybersecurity suited to the AI era. The Financial Services Commission directed institutions to inspect their defences, tighten access controls, reduce external-system exposure and strengthen consumer protection. [4] [5]
The Financial Supervisory Service and the Financial Security Institute also shared 28 unique suspect IP addresses and some country information with financial firms, according to Reuters. An IP address is a network identifier; it can help investigators trace activity, but it does not by itself prove where a person is located. [2] [5]
What the technical evidence shows
CrowdStrike says the activity involved ARTEX, a recently released open-source agentic penetration-testing tool developed in China, alongside large language models. In plain English, an agentic tool is software designed to carry out a sequence of tasks with less step-by-step direction. Penetration testing normally means authorised security testing, but the report describes ARTEX in infrastructure associated with an unauthorised campaign. [1]
CrowdStrike’s analysts found ARTEX configuration files, Claude Code session histories and Claude memory files in open directories linked to threat-actor-controlled infrastructure. Claude Code is a coding assistant, while memory files can preserve information from earlier sessions. The report describes a two-server arrangement and says the ARTEX instance used DeepSeek as its primary model, with other models used in additional sessions. [1]
Those findings show how an operator may combine an agentic security tool with general-purpose AI coding sessions and conventional offensive infrastructure. They do not mean the AI providers or model developers carried out, authorised or endorsed the intrusions. A tool’s country of development also does not establish the operator’s location or the identity of whoever directed the activity.
The sessions described by CrowdStrike included requests related to Korean data-breach sales channels and a résumé describing security-research work. One session contained personal details that appeared to point towards someone in Guangdong. The report's stated age and date of birth do not agree, so neither an exact age nor an identity is established here. CrowdStrike cautioned that the available information could not definitively associate those details with the actor; Reuters also presented the location as a possibility, not a confirmed identification. [1] [2]
Why this South Korea bank cyber attack matters
The immediate significance is operational. AI-assisted workflows can help an operator move quickly through reconnaissance, vulnerability research, documentation and data handling. Reconnaissance means gathering information about a target; a vulnerability is a weakness that may be exploited. CrowdStrike’s account suggests that agentic tooling was used alongside traditional capabilities rather than replacing them. [1]
For banks, that means defence cannot focus only on a named malware family or one institution’s perimeter. Security teams also need to watch for exposed development artefacts, unusual automation, stolen session material and movement between connected systems. The reporting does not show that AI alone caused the breaches, or that every use of AI creates the same risk.
The South Korean response illustrates why a banking cyber attack can become a sector problem. Regulators asked institutions to inspect systems and share threat information, while investigators considered whether the attacks scanned multiple companies for weaknesses. Common suppliers, internet-facing services and identity controls can create shared exposure; a weakness tested at one firm may be relevant to others. [3] [4]
What remains unclear and unconfirmed
Several central questions remain open. The full number of affected organisations, the complete set of compromised systems, the quantity and type of exfiltrated data, and whether customer funds were accessed have not been established in the opened sources. The reported 89-client Hana data exposure is specific to that account and is not a sector-wide total. [3]
Attribution is even less settled. CrowdStrike’s moderate-confidence assessment says the actor was likely Chinese-speaking and financially motivated, based partly on a Chinese-developed tool and observed Chinese-language prompts. Those indicators are not proof of nationality, citizenship, residence or government direction. IP addresses can be routed through other countries, tools can be obtained internationally, and language in a session does not identify a person. [1]
Reuters reported that South Korea’s opposition had urged officials to examine possible North Korean involvement. That political call is not an investigative finding and does not establish any state actor. The possible Guangdong identity remains a lead under investigation. No named attacker has been confirmed in the sources reviewed here, and there is no confirmed finding that China, North Korea or any other government ordered, sponsored or controlled the campaign. [2] [4]
What happens next
South Korean police and financial regulators are expected to continue examining the affected institutions, the reported infrastructure and the information exposed. The most useful next disclosures would be a verified incident count, institution-by-institution impact statements, confirmed data categories, and an official account of whether the same operator or infrastructure linked the cases. Banks may also provide customer-notification or remediation details as investigations progress. [2] [3] [4]
Independent forensic evidence or a government conclusion could strengthen, narrow or overturn the current assessment. Until then, “likely Chinese-speaking,” a possible Guangdong lead and use of a Chinese-developed tool should not be mistaken for a confirmed Chinese attacker or state operation. The investigation, breach scope and attribution may change as more evidence is examined.
