CrowdStrike

South Korea b

2026-10-08 10:15:28

AI-assisted attacks hit South Korean banks after Claude Code logs were left exposed

Several major financial institutions in South Korea, including Shinhan Bank, KB Kookmin Bank and Hana Bank, were hit by a string of cyberattacks that exposed the personal data of tens of thousands of customers. A report released by CrowdStrike on Oct. 7 said the activity may have been carried out by a single attacker, despite the scale and complexity of the incidents. According to the investigation, the attacker used ARTEX, an open-source agentic penetration testing tool developed in China, and tied it to several AI models and services, including DeepSeek, Zhipu AI’s GLM, xAI’s Grok and Claude Code. The campaign reportedly targeted a loan-status inquiry service used by financial intermediaries and a mobile office system used by bank staff between late September and early October 2026. The inquiry took an unusual turn when researchers found that the attacker had failed to disable directory listing on a server under their control. That mistake exposed Claude Code session records, configuration files and memory files, allowing investigators to see how the AI tools were configured and what prompts had been used. Among the exposed requests were questions about where stolen South Korean data is typically sold and a request for help drafting a cybersecurity researcher résumé. CrowdStrike said it has not formally attributed the incident to any specific individual or hacking group.

270

South Korea

2026-10-08 10:26:15

South Korean financial institutions hit by suspected AI-assisted attacks as investigators trace clues in Claude Code logs

At least seven financial institutions in South Korea were hit by data breaches from late September to early October, with Shinhan Bank, KB Kookmin Bank and Hana Bank among the affected names. Publicly disclosed figures show about 25,000 Shinhan Bank customers and roughly 40,000 customers at Yegaram Savings Bank were impacted. Exposed data included names, phone numbers, annual income and loan limits, though no stolen funds have been identified so far. South Korean regulators suspect the incidents may be tied to a single attacker because several of the intrusions shared overlapping IP addresses. On Oct. 6, President Lee Jae-myung said the attacks may have involved AI. A day later, CrowdStrike released more detailed findings, saying investigators found evidence tied to two servers, one in Hong Kong used to control the operation and another running the open-source AI penetration testing system ARTEX. According to CrowdStrike, exposed server directories allowed investigators to obtain ARTEX configuration files, Claude Code chat logs and AI memory files. The configuration showed the attacker mainly used DeepSeek v4.1-flash with ARTEX, while other sessions also referenced Claude Code, GLM-5.3 and Grok 4.6. Chat records also contained apparent personal details, but CrowdStrike said the attacker’s real identity remains unconfirmed.

330

South Korea

2026-10-08 10:29:26

South Korea probes string of bank data leaks as AI tools surface in attack trail

South Korea is investigating a wave of data breaches that hit at least seven financial institutions from late September to early October, including Shinhan Bank, KB Kookmin Bank and Hana Bank. Known victim counts include about 25,000 customers at Shinhan Bank and roughly 40,000 at Yegaram Savings Bank. Exposed data included names, phone numbers, annual income and loan limits, while no theft of funds has been identified so far. Authorities suspect the incidents may be linked because several attacks shared overlapping IP addresses. On Oct. 6, South Korean President Lee Jae-myung said the attacks may have involved AI. A day later, CrowdStrike said the threat actor used one server in Hong Kong to control the operation and another to run the open-source AI penetration testing system ARTEX. Investigators reportedly obtained ARTEX configuration files, Claude Code chat logs and AI memory files. According to CrowdStrike, the configuration showed ARTEX was mainly powered by DeepSeek v4.1-flash. The attacker also used Claude Code and, in other sessions, called GLM-5.3 and Grok 4.6. Chat records showed queries about where stolen South Korean data could be sold and which Telegram groups were used for trading. CrowdStrike said the actor may be a Chinese-language user with a profit motive, but the person’s real identity remains unconfirmed.

440

ARTEX

2026-10-09 09:40:41

ARTEX author shuts project after tool was linked to AI-enabled attacks on South Korean banks

ARTEX, an open-source AI penetration testing tool, has been taken closed-source after being linked to attacks on multiple financial institutions in South Korea. Developer Autumn-27 said on Oct. 8 that the project would stop updating, would no longer release new versions, and would not provide maintenance support going forward. The project’s original GitHub repository was later removed. ARTEX is described as a multi-agent system that can connect to different large language models, automatically identify vulnerabilities, and carry out penetration tests. Earlier, cybersecurity firm CrowdStrike said attackers connected to the South Korean bank incidents had used ARTEX. The firm also found the tool’s configuration files and Claude Code chat records on a server tied to the case. In a statement, Autumn-27 said ARTEX had been built for learning, research, and authorized enterprise security testing. The developer said the tool’s use in illegal attacks ran completely against its original purpose, condemned unauthorized use, and said they would not take responsibility for that activity. Even so, copies of the source code have already been backed up by other developers, meaning previously released versions may still be used and modified.

250

CrowdStrike

2026-10-06 12:17:47

CrowdStrike, AWS and Nvidia expand global cybersecurity startup accelerator

CrowdStrike, Amazon Web Services (AWS), and Nvidia have expanded a global accelerator for cybersecurity startups, according to a newsflash published by ChainCatcher. The brief said the initiative is aimed at shaping the next wave of innovation for the agentic era. No additional details were provided in the source about the program’s scale, timeline, participating startups, or geographic rollout. The update was published as a 7x24 newsflash, and the original item did not include further background beyond the announcement itself.

260

CrowdStrike

2026-10-09 02:03:38

CrowdStrike says AI-assisted hacker hit Korean banks, then exposed identity clues through Claude logs

CrowdStrike said a wave of cyberattacks targeting South Korean financial institutions since late September 2026 involved ARTEX, an open-source AI penetration tool developed in China, paired with large language models including DeepSeek v4.1-flash and Anthropic’s Claude Code. The attacks affected multiple banking systems, including a loan progress inquiry service and an employee mobile work support platform. Shinhan Bank said about 25,000 customers had personal data accessed illegally, while Kookmin Bank reported leaks involving 119 customers. The case drew wider attention because the attacker appears to have exposed their own operational trail. According to CrowdStrike, an open directory on infrastructure controlled by the threat actor contained full Claude Code session logs, configuration files, and memory files. Those records allegedly included prompts asking where South Korean personal data could be sold, requests to search Telegram groups trading Korean data, and an instruction for Claude to draft a cybersecurity researcher résumé that listed the ARTEX-based attack on Korean banks as work experience. The leaked résumé prompt contained identity clues including the alias Y.Y, an age listed as 26, an initially provided birth date of 2007-09-22, South China University of Technology, Maoming in Guangdong province, a phone number, and a Telegram handle. South Korean authorities have opened a formal investigation, while CrowdStrike said it assesses with medium confidence that the actor was a Chinese-language user motivated by financial gain.

280

CrowdStrike

2026-09-29 17:35:45

CrowdStrike connects Falcon platform to OpenAI marketplace

CrowdStrike said it has connected its Falcon platform to the OpenAI marketplace, according to a brief update carried by ChainCatcher. The source report did not provide additional details on the scope of the integration, launch timing, or specific product features tied to the move. The announcement only stated that Falcon has been brought into the OpenAI marketplace. No further information on commercial terms, user access, or rollout plans was disclosed in the source material.

340

Bank of Ameri

2026-09-21 03:33:51

BofA says rising AI security fears are turning cybersecurity into a rare two-way winner

Bank of America said in a Sept. 18, 2026 research note that growing concern over AI security is becoming a durable catalyst for cybersecurity stocks, as investors shift from worrying that AI could disrupt security software to recognizing that it creates new attack surfaces, new identities and new governance demands. The bank pointed to recent market performance as evidence that this repricing is already underway: over the past month, the HACK and CIBR cybersecurity ETFs rose 7.3% and 6.4%, compared with a 2.8% gain for the IGV software ETF and a 0.9% decline in the S&P 500. BofA raised its price targets on CrowdStrike, Okta and SailPoint, while keeping all three at Neutral. The firm argued that cybersecurity is one of the few sectors that can benefit from both positive and negative AI headlines. Negative developments raise awareness of threats and can support spending, while positive developments help validate the value of security investment. The report highlighted identity management as a core theme for protecting AI agents, which it said will need authentication, authorization, monitoring and governance. It also said platform security vendors such as CrowdStrike could benefit as enterprises look to integrate controls across identity, endpoints and networks. Even so, BofA said current share prices already reflect a meaningful amount of optimism.

640