CrowdStrike Report Names Suspected Hacker in South Korea Finance Attacks
CrowdStrike says it found personal information of a suspected attacker by analyzing usage records of AI coding tools used in attacks on South Korean financial institutions.
CrowdStrike has published a report identifying personal information of a suspected attacker behind a hacking campaign targeting South Korean financial institutions, according to the report on the company's website. The company said it found the details while analyzing usage records of AI coding tools and related infrastructure used in the attacks, according to etnews.com.
The attacker used the recently released Chinese open-source penetration testing tool ARTEX together with a large language model, according to the report. CrowdStrike assessed with 'medium confidence' that the attacker is a Chinese-speaking individual likely motivated by financial gain.
A Claude Code usage record contained a request to write a security researcher resume based on hacking achievements, including a Telegram account, age, education, and the Maoming area of Guangdong Province.
Earlier Investigative Context
Information leak incidents had occurred at multiple South Korean financial institutions including Shinhan Bank and KB Kookmin Bank, after which police launched an investigation into the cyberattacks. President Lee Jae-myung said at a later point that signs of AI use appeared in some hacking cases and called for strengthened cybersecurity response.
Quick answers
What did CrowdStrike find in the AI coding tool records?
A Claude Code usage record contained a request to write a security researcher resume based on hacking achievements, including a Telegram account, age, education, and the Maoming area of Guangdong Province.
What tool did the attacker use?
The attacker used the recently released Chinese open-source penetration testing tool ARTEX together with a large language model.
How confident is CrowdStrike about the attacker's identity?
CrowdStrike assessed with 'medium confidence' that the attacker is a Chinese-speaking individual likely motivated by financial gain.