CrowdStrike said it had identified infrastructure associated with a campaign targeting South Korean financial organisations from late September to early October. Its researchers found Claude Code session histories, ARTEX configuration files and memory files in attacker-controlled open directories. CrowdStrike assessed with moderate confidence that the unknown actor was likely Chinese-speaking and financially motivated. It did not attribute the campaign to a named adversary.
The forensic assessment adds technical evidence to a series of bank data breaches already under investigation in South Korea. Authorities had identified attacks or attempted intrusions affecting institutions including Shinhan Bank, KB Kookmin Bank and Hana Bank. President Lee Jae Myung ordered a wider investigation and called for resources to limit the damage. The new CrowdStrike report addresses the suspected tooling and operating method rather than determining the full breach scope.
OPEN DIRECTORIES EXPOSED THE ATTACK TOOLCHAIN
CrowdStrike said a Hong Kong-based internet address led researchers to additional directories containing the coding histories and ARTEX files. The material indicated a two-server architecture, with a separate address hosting the ARTEX instance described in the sessions. ARTEX is an open-source agentic penetration-testing tool that connects to external large language models.
The recovered sessions showed the actor using artificial-intelligence models alongside conventional offensive infrastructure. CrowdStrike said the ARTEX instance used DeepSeek as its main model backend and that other sessions used additional models. The company also found Chinese-language prompts and queries about selling Korean breach information, which contributed to its language and financial-motive assessment.
ATTRIBUTION REMAINS LIMITED AND CONDITIONAL
Some session material contained personal details linked to a 26-year-old in Guangdong, but CrowdStrike did not identify that person as a confirmed perpetrator. Reuters reached a person at a telephone number cited in the report who denied knowledge of the matter. Anthropic, South Korean police and China’s foreign ministry did not immediately respond to Reuters requests for comment.
The findings show how an agentic testing framework may be repurposed against financial institutions, but they do not establish state sponsorship or final responsibility. South Korean police and financial regulators continue to investigate the bank incidents and their combined scope. A formal attribution, confirmed breach mapping and any regulatory findings are the next material milestones.