Suspected Chinese-speaking hacker used AI tool to breach South Korean banks

By Splitfeed EditorialLast updated Oct 8, 2026, 10:40 UTC

Around October 6 to 8, 2026, CrowdStrike published a report attributing a series of cyberattacks on multiple South Korean financial institutions to a suspected Chinese-speaking actor. The attacker used ARTEX, an open-source automated penetration-testing tool that incorporates AI models including DeepSeek and GLM-5.3. Shinhan Bank alone lost more than 25,000 customer records, and South Korean officials placed the total number of affected customers across institutions at 68,000. Some coverage, including from Benzinga, named Anthropic's Claude as an additional AI model linked to the attacker, though CrowdStrike's detailed account focused on ARTEX, DeepSeek, and GLM-5.3. South Korean megachurches separately announced they were investigating suspected AI-linked attacks around the same period.

The CrowdStrike assessment carries a specific and significant claim: AI-assisted tooling may have allowed what officials believe was a single actor to compromise multiple institutions, achieving a scale and technical sophistication that would previously have required a team with specialized skills. South Korean officials stated directly that AI models now enable attackers to hack with ease even without deep technical expertise. That framing matters because it shifts the conversation from AI being a marginal efficiency boost to potentially being a barrier-lowering force in offensive cyber operations, raising questions about how financial regulators, security vendors, and governments should respond when the skill floor for serious attacks drops.

None of the three camps, Pro-AI, Anti-AI, and Middle Ground, have published reactions to this specific story yet. Anti-AI voices would typically treat this as confirmation that freely available AI models carry real-world harm potential, pointing to the use of open-source tools and Chinese-developed models as evidence that the risks of wide AI access outweigh the benefits. Pro-AI voices would typically argue that the problem lies with inadequate cybersecurity defenses and the open-source distribution of penetration-testing tools, not with AI development itself, and that the same AI capabilities also power the defensive systems catching these attacks. Middle Ground observers would likely call for targeted regulatory focus on how AI is packaged into offensive tooling, rather than broad restrictions on AI models generally.

The most consequential near-term developments to watch are any formal attribution statement from South Korean or allied government agencies naming the actor more specifically, and any regulatory or legislative response from South Korea's financial supervisory bodies regarding AI-assisted threat disclosure requirements for banks.