CrowdStrike Links South Korean Bank Breaches to China-Based Attacker Using AI Agents

CrowdStrike disclosed on October 8 that a China-based threat actor likely used autonomous AI tools to breach South Korea's financial sector, targeting at least seven to nine banks and extracting customer data in a campaign spanning late September through early October. The cybersecurity firm identified the suspect as a probable 26-year-old Chinese speaker based in Guangdong province who deployed ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Claude, DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to carry out reconnaissance, vulnerability identification, and data exfiltration at scale and speed.