CrowdStrike traces attacks on nine South Korean financial firms through exposed Claude Code logs

How the investigation unfolded

On October 7 local time, CrowdStrike published an analysis of infrastructure linked to a campaign against South Korean financial institutions. According to the report, the IP address 38.244.50[.]120 hosted an instance of ARTEX, an open-source autonomous penetration-testing framework, next to a directory that was open to anyone. Inside sat a Claude Code Markdown file containing a penetration-testing prompt written in Chinese and a second IP address, in Hong Kong.

Following that lead, CrowdStrike recovered more Claude Code session histories, ARTEX configuration files and Claude memory files. Together they described a two-server setup: the Hong Kong machine acted as the main control server, while the ARTEX instance on the other address carried out the intrusions.

Two servers and three AI models

CrowdStrike's findings, relayed by Japanese outlet Joho no Todai, show ARTEX running on DeepSeek v4.1-flash as its main language-model backend, with separate Claude Code sessions using GLM-5.3 from Zhipu AI and Grok 4.6. Access to DeepSeek may have been routed through xcai[.]pro, an LLM API proxy reseller. The company also published nine proxy IP addresses as indicators of compromise.

ARTEX appeared on GitHub on July 26. It combines LLMs with a multi-agent architecture to automate reconnaissance, vulnerability discovery, attack-path planning, execution and verification. It was written mainly for Chinese-speaking users, but anyone can download it.

Identity clues in a resume

Not everything in the logs related to the intrusion itself. In one session, the attacker asked Claude Code to draft a security researcher's resume and to list the results of the attacks as achievements. The prompt contained personal details: Telegram account @YY520CN, age 26, a degree from South China University of Technology and a residence in Maoming, Guangdong province. The same handle had appeared in earlier vulnerability research against a Telegram-based NFT marketplace and in attacks on a Chinese payment platform. Another session included a question about finding Telegram groups where the leaked South Korean data could be sold.

CrowdStrike considered it likely that these details belong to someone involved in the ARTEX attacks, but stated it "cannot definitively attribute" the activity. Its assessment that the attacker is Chinese-speaking and financially motivated carries only moderate confidence, and the company did not link the campaign to the Chinese government.

Nine targets, uneven damage

Nine South Korean financial institutions were attacked, and data leaks were confirmed at seven of them. Figures reported by Joho no Todai put Shinhan Bank at roughly 25,000 affected people and Yegaram Savings Bank at around 40,000, with KB Kookmin Bank (119), Hana Bank (89), BNK Busan Bank (11 contractor staff), Welcome Savings Bank and Hyundai Capital also affected. The campaign touched data relating to more than 65,000 people in total. Woori Bank and NH NongHyup Bank were attacked too, but escaped damage because the targeted vulnerabilities were not present on their systems.

The entry points were not customer-facing online banking platforms but business support systems used by employees and loan brokers, such as services for checking loan application status and mobile tools for sales representatives. These sit on the internet yet generally receive less protection than core transaction systems. South Korea's Financial Security Institute independently confirmed ARTEX use from Shinhan Bank's attacking IP addresses and server logs, while noting that IPs in eight countries were involved, making attribution by address alone unreliable. On October 6, President Lee Jae-myung told a cabinet meeting that some hacking incidents showed signs of AI use and ordered a comprehensive overhaul of cyber defences for the AI era.

Why it matters

The case illustrates both sides of AI-assisted offence. One operator, using an open-source multi-agent framework and commodity LLM APIs, ran intrusions against nine financial institutions in a short period. Yet South Korea's Financial Security Institute was clear that AI acted as a tool under human direction, not autonomously, and the human's tradecraft was poor: operation logs in a publicly readable directory, attack results listed on a resume, and an AI query about where to sell stolen data gave investigators their breakthrough. AI accelerated reconnaissance and intrusion without improving the attacker's ability to cover tracks. For defenders, the lessons are to give externally exposed business support systems the same scrutiny as core banking platforms, and to treat AI session histories and configuration files left on attacker infrastructure as a valuable new class of forensic evidence.