Korean Bank Hacker Asked Claude Where To Sell The Stolen Data, Crowdstrike Says

What Happened

President Lee Jae Myung then raised the AI question at a Cabinet meeting. Police have since opened a full-scale investigation.

“In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety,” he said.

CrowdStrike published its findings on October 7. Open directories on attacker-controlled servers held histories from Claude Code, Anthropic’s AI coding assistant, along with configuration files.

“Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor’s operational methodology and tooling,” the report read.

DeepSeek also featured in an August TeamT5 report on Chinese hackers. The Taiwanese firm found state-linked groups doubled their attack volume after adopting DeepSeek and open-source AI.

A Résumé Request May Point to the Hacker

Market Context

The Attacker Asked About Telegram Markets

The same Telegram handle appeared in Claude Code sessions probing a Telegram-based NFT gift marketplace for flaws.

Why It Matters

A Hong Kong-based server acted as the attacker’s main infrastructure. An IP address ran the ARTEX instance that CrowdStrike says was likely behind the Korean attacks.

CrowdStrike has not named any group behind the campaign. It assessed with moderate confidence that the actor is likely a financially motivated Chinese speaker. That view rests on ARTEX and the Chinese-language prompts.

CrowdStrike said the details likely belong to the attacker but cannot be definitively linked to them. The firm also noted the attacker first entered a 2007 birth date.

“While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” CrowdStrike added.

Details

The suspected attacker behind South Korea’s recent bank breaches asked an AI coding tool where breach data sells. CrowdStrike found the request in session logs stored in open directories on attacker-controlled servers.

Several South Korean banks have disclosed customer data leaks over the past week. CrowdStrike’s October 7 report says the campaign used a Chinese-built AI penetration testing tool and several language models.

What Is Known So Far About the Korean Bank Breaches

A string of attacks hit several Korean lenders in succession between late September and early October. Shinhan Bank confirmed its breach on September 30 and said a day later that about 25,000 customers were affected. The intruder slipped past identity checks on a mobile service loan agents use to track applications.

The exposed records covered names, phone numbers, annual income, and calculated loan limits. They also included 66 resident registration numbers, South Korea’s national ID numbers.

KB Kookmin Bank followed on October 2, saying data on 119 customers leaked through a mobile system its employees use. Hana Bank disclosed 89 affected customers, while BNK said records on 11 outsourced workers were taken.

Follow us on X to get the latest news as it happens

An Open Server Exposed the Attacker’s AI Conversations

According to the report, the attacker worked with ARTEX, an open-source agentic penetration testing (pentesting) tool developed in China.

CrowdStrike said the ARTEX instance used DeepSeek v4.1-flash as its main AI model. The attacker also used Zhipu AI’s GLM-5.3 and xAI’s Grok 4.6 in other Claude Code sessions.

Alongside the ARTEX operation, the attacker asked Claude where threat actors typically sell Korean breach data. The same user wanted help finding Korean Telegram groups that sell such data.

In another session, the user asked Claude to write a security researcher résumé showcasing the ARTEX results. The prompt listed a Telegram handle, an age of 26, and a location in Maoming, Guangdong.