AI-agent campaign hits South Korean banks

CrowdStrike reported on October 7 that a suspected Chinese-speaking, financially motivated actor targeted South Korean financial institutions from late September into early October. The actor used ARTEX, an open-source agentic penetration-testing tool developed in China, together with Anthropic’s Claude Code. CrowdStrike reconstructed the operation from the actor’s exposed Claude Code session histories and memory files. It attributes the activity with moderate confidence.

The way in was unremarkable. The actor went through a loan-inquiry service and an employee mobile work-support system. That is the kind of web-facing application a community bank or its digital-banking provider also runs.

CrowdStrike expects more of the same. “Adversaries will likely continue to experiment with implementing AI tooling in their operations to enhance their operational tempo and capabilities,” it wrote.

What this means for your bank

Ask your digital-banking and loan-origination providers when their web-facing applications were last tested, and request the results.
Add an AI-assisted intrusion scenario to your next incident-response tabletop.

Sources

Unknown threat actor uses ARTEX to target South Korean finance (CrowdStrike)crowdstrike.com ↗

This is for information only and is not legal advice. Verify the details against the linked report before acting.

Keep reading

Frontier AI crosses the “Critical” cyber line

A cloned voice moved €95 million out of an Italian private bank

Browse the full Regulatory Radar