Recent analysis by a global cybersecurity firm suggests that the hacker targeting South Korean financial institutions may be a 26-year-old residing in Guangdong, China. Evidence indicates that the attacker inadvertently exposed personal identifiers while using generative artificial intelligence (AI).
On October 7, CrowdStrike released a report indicating that it had captured clues pointing to the identity of the hacker involved in the attacks on South Korea's financial sector.
According to CrowdStrike, the identity clues emerged when the hacker utilized the AI coding tool 'Claude Code.' The attacker requested AI assistance in creating a resume that detailed their penetration testing achievements, during which personal information such as initials, a Telegram account, educational background, and residence were input.
Additionally, the report revealed that the hacker inquired about where to sell stolen South Korean financial data and how to locate Telegram data sales channels. The same Telegram account was also linked to investigations into vulnerabilities in a Telegram-based non-fungible token (NFT) gift marketplace and an attack targeting a payment platform in China.
Based on these findings, CrowdStrike suggested that the attacks might have been carried out by the same individual. However, they emphasized that further verification is needed to confirm the identity.
The report noted that the hacking incidents involved the use of an open-source penetration testing tool called 'ARTEX,' developed in China. This tool automates the process of identifying vulnerabilities and attempting intrusions using AI. The primary model used was DeepSeek 'v4.1-Flash.' The attacker also employed other large language models (LLMs) such as 'GLM-5.3' and 'Grok 4.6' from Chinese company Zifu AI during the Claude Code sessions.
The hacking incidents targeting South Korean financial institutions came to light following breaches at seven financial companies, including Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram, Welcome Savings Bank, and Hyundai Capital, between late last month and early this month.
Financial authorities believe that the attacker switched IP addresses during the assaults and conducted automated attacks on multiple financial institutions using AI tools. According to data compiled by the Financial Supervisory Service, there were 33 IP addresses used in the hacking attempts, with 28 unique addresses after excluding duplicates.
Evidence of the use of the Chinese AI autonomous penetration testing tool 'ARTEX' has also been detected, prompting an ongoing investigation by the police.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.