The suspect behind recent cyberattacks on South Korea’s financial sector may be a 26-year-old in China’s Guangdong province. In a report published Wednesday, U.S. cybersecurity firm CrowdStrike said it found personal details linked to the suspected attacker while analyzing AI coding-tool sessions and infrastructure tied to a campaign running from late September to early October.

CrowdStrike said the individual asked Claude where threat actors typically sell Korean data breach information and sought help finding Korean Telegram data sale groups. 

In another session, the person asked Claude to create a security researcher resume. It listed a Telegram account, age, educational background, and a location in Maoming, a city in southern Guangdong, which CrowdStrike said likely belonged to the attacker.

A man who answered a phone number provided in the report said he knew nothing about the matter, and Anthropic, South Korean police, and China’s foreign ministry did not immediately respond to requests for comment, according to Reuters.

ARTEX is an open-source AI agent for automated penetration testing, published on GitHub this year by a Chinese security engineer using the handle “Autumn.” It is not a standalone large language model (LLM), but connects to external models such as ChatGPT, Claude, and DeepSeek to help organizations test their networks for vulnerabilities. 

Its GitHub page says it is meant for personal learning, code research and local technical verification, not real-world testing against online systems or websites.

CrowdStrike has not attributed the activity to a named adversary. It said, with moderate confidence, that the actor is likely a Chinese speaker and financially motivated, based on ARTEX use and Chinese-language prompts.

“Activity at multiple organizations purportedly involved overlapping IP addresses,” CrowdStrike said. “Reporting also suggested the attacker used ARTEX based on references to the string ARTEX in HTML files observed on a reportedly threat actor-controlled server.”

Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, and Hyundai Capital suffered data breaches between September 27 and 30, reports say. 

Shinhan Bank said last week that personal information of 25,727 customers was compromised. KB Kookmin Bank said 119 customers’ personal information was leaked, and Hana Bank said 89. 

The case is likely to intensify concerns over AI agents and whether organizations can defend against them. 

Australia said last month that an OpenAI autonomous agent breached a government health statistics portal in June, one of the first known cases of an AI agent hacking a government system.

In other recent news, suspected AI-linked cyberattacks targeting two Seoul megachurches may have exposed data of 850,000 members. In August, feds warned that hackers now use AI to write exploits targeting U.S. water systems’ Siemens PLCs.