Chinese Hacker Deployed AI in Campaign Against South Korean Banks

CrowdStrike reported that a likely China-based, financially motivated actor used ARTEX and multiple LLM backends (including Claude, DeepSeek, GLM-5.3 and Grok) in an agentic AI-enabled campaign from late September to early October 2026 to discover vulnerabilities and exfiltrate data from South Korean financial firms — including breaches at Shinhan Bank and Yegaram affecting tens of thousands of customers — with activity linked to attacker-controlled IPs and open directories holding ARTEX/Claude artifacts.