CrowdStrike says hacker behind South Korean bank attacks likely operated from China
The cybersecurity firm says a lone actor likely used AI tools to breach multiple South Korean financial institutions
A wave of cyberattacks that hit South Korea’s banking sector this fall may trace back to a single person with a laptop and some very capable AI tools. That is the picture painted by CrowdStrike, which says the hacker likely operated from China.
The cybersecurity firm’s findings land as South Korean police open a formal investigation. Customers at several major banks are now wondering what exactly walked out the door.
What CrowdStrike found
CrowdStrike published its report on October 8, 2026. It covers a string of attacks on South Korean financial institutions that ran from late September into early October.
According to the analysis, the threat actor is likely a 26-year-old Chinese-speaking man based in Maoming, a city in Guangdong province. CrowdStrike did not tie him to any organized hacking group.
CrowdStrike’s read is different: one individual, likely chasing a payday. The firm characterized the campaign as potentially motivated by financial gain rather than espionage or politics.
The attacker’s infrastructure included a control server located in Hong Kong. That server effectively served as the remote command post for the operation.
The AI toolkit
The most striking part of the report is the tooling. CrowdStrike says the attacker relied on ARTEX, a Chinese-developed penetration-testing agent.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The attacker also used other AI models, including Claude and Claude Code, for research and scripting tasks.
Who got hit
The breaches touched at least seven to nine South Korean banks and financial entities. Data exfiltration, meaning information was actually copied out of the institutions’ systems, was confirmed in several cases.
Shinhan Bank reported approximately 25,000 affected customers. KB Kookmin Bank confirmed 119.
South Korea’s Financial Services Commission moved quickly on the consumer side. On October 6, two days before CrowdStrike’s report went public, the regulator issued an alert warning the public about potential scams linked to the breaches.
The policy response
The scale of the attacks prompted South Korean police to launch a formal investigation. President Lee Jae Myung has called for strengthened cybersecurity measures.
Why this case stands out
CrowdStrike framed the incident as part of a growing trend. Individual actors are increasingly leveraging sophisticated AI technology to commit cybercrime that once demanded far more resources.
What this means
There is also a quieter question hanging over the AI industry itself. The attacker reportedly used both a purpose-built Chinese penetration-testing agent and general-purpose models like Claude and Claude Code, which means the debate over how AI developers police misuse of their tools is likely to intensify.