CrowdStrike: Solo Attacker Used AI Toolchain to Hit Multiple South Korean Banks

CrowdStrike has released a report suggesting that last week's cyberattacks on several major Korean banks may have been carried out by a single individual. According to @TechNadu, the attacks involved at least 9 Korean banks, and the suspect is reportedly just 26 years old and allegedly used AI tools to carry out the intrusions.

Confirmed

• Per the CrowdStrike report relayed by @Nunki08, @SOhEigeartaigh and others, the attacker combined the open-source AI penetration testing tool ARTEX with multiple models including DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude.
• @TechNadu cites the report noting that ARTEX-related attack traces and Claude Code session logs exposed the attacker's trail, even containing information that could pinpoint their identity — becoming key to solving the case.
• The suspect is 26 years old, and the targets included at least 9 Korean banks.

Why it matters

• The incident is seen as a landmark case of AI tools lowering the barrier to cyberattacks: a single person can launch attacks against major financial institutions using a multi-model toolchain.
• It also illustrates the double-edged nature of AI use — the Claude Code session logs became a crucial source of accountability evidence, showing that AI-assisted attacks still leave traceable digital footprints.

2026-10-08 ~ 2026-10-09 · 9 related posts

Full story(2 episodes)→

• Episode 1: Korean Banks Hacked with Chinese AI Agent in Possible First(2026-10-07, 2 posts)
• Episode 2: CrowdStrike: Solo Attacker Used AI Toolchain to Hit Multiple South Korean Banks(2026-10-08, 9 posts)

• [source] CrowdStrike: 26-year-old hacker hit 9 Korean banks, Claude Code sessions exposed clues — TechNadu · 2026-10-08
• CrowdStrike Links Korean Bank Hacks to ARTEX and Claude Code Sessions — TechNadu · 2026-10-08
• [source] CrowdStrike: South Korea bank hack may have been a single attacker wielding ARTEX and multiple AI models — S_OhEigeartaigh · 2026-10-08
• CrowdStrike: South Korea bank hack may be one person wielding ARTEX plus multiple AI models — Nunki08 · 2026-10-08
• AI security scan: ARTEX + Claude Code used against Korean banks, npm worm, LMCache RCE — brucemacv · 2026-10-08
• [source] Korean bank hackers asked Claude where to sell stolen data; ARTEX agent tied to 7-bank breach — rohanpaul_ai · 2026-10-09
• CrowdStrike: unknown actor used AI-driven ARTEX pentest tool against South Korean finance — rohanpaul_ai · 2026-10-09

2 near-duplicate retellings: connoraxiotes · dyn___