Chinese Hacker Deploys AI Tools in Recent Attacks on South Korean Banks

South Korean financial institutions experienced a coordinated wave of cyber intrusions earlier this month, which investigators traced back to a single individual operating from China.

Forensic analysis revealed that the attacker leveraged the ARTEX AI penetration‑testing suite—a commercial tool designed to simulate network attacks—to identify vulnerabilities across multiple bank networks. In parallel, the hacker employed Claude agents, an advanced conversational AI platform, to automate the exploitation process and manage the intrusion workflow.

The combination of a dedicated AI testing framework with a language‑model‑driven assistant allowed the perpetrator to bypass traditional security controls at a speed that outpaced human analysts. By automating reconnaissance, credential harvesting, and lateral movement, the malicious actor was able to compromise sensitive systems in a matter of hours, prompting temporary service disruptions and heightened alerts across the sector.

South Korea's Financial Services Commission has confirmed that no customer funds were directly stolen, but the incidents exposed critical gaps in the banks' defensive posture against AI‑augmented threats. The affected institutions have since enacted emergency patches, reinforced multi‑factor authentication, and launched internal reviews of their AI usage policies.

Security experts warn that the episode underscores a broader shift in cybercrime, where readily available AI tools lower the barrier to entry for sophisticated attacks. The use of a commercial penetration‑testing product for malicious purposes raises questions about vendor responsibility and the need for stricter licensing controls, while the deployment of Claude agents highlights the dual‑use nature of generative AI technologies.

Authorities are now collaborating with international partners to track the hacker’s infrastructure and to develop guidelines that balance legitimate security testing with the prevention of abuse. Meanwhile, banks across the region are expected to invest in AI‑aware detection systems and to train staff on recognizing automated threat patterns, aiming to stay ahead of attackers who increasingly rely on machine‑learning assistants to scale their operations.