Most hacking attacks on South Korean financial firms go unidentified, lawmaker says, as AI-powered breaches surge

The vast majority of overseas hacking attacks on South Korean financial firms since 2024 have gone unsolved, a lawmaker said Friday, highlighting a systemic vulnerability that the recent breach of multiple major banks has thrown into sharp relief.

According to a report by Rep. Song Eon-seok of the main opposition People Power Party, citing data from the Financial Supervisory Service, local financial firms have reported 18 hacking attacks originating overseas since 2024 through Thursday. Attackers were identified in only two cases.

In July last year, Seoul Guarantee Insurance Co. suffered a ransomware attack by the international group GUNRA, disrupting operations for 64 hours. In April, Baro Savings Bank was hit by the ransomware group INC Ransom. The other 16 cases remain unsolved, with 13 linked to IP addresses believed to be located overseas and three with unknown countries of origin. Identified IP origins included China, the United States, Bulgaria and Vietnam, though a lawmaker noted that IP addresses can be easily concealed or disguised.

The report comes as a wave of data breaches at major Korean banks has shaken customer confidence and put pressure on deposits, according to local reports. Last week, several financial companies including Hana Bank, KB Kookmin Bank and Shinhan Bank suffered leaks of customer information.

The South Korean Financial Services Commission said more than 68,000 people have been affected by the hacks. Shinhan Bank reported that information attached to loan applications for about 25,000 customers had been leaked, including names, phone numbers and annual income. Yegaram Savings Bank saw about 40,000 customers affected, according to Bloomberg.

**AI tools in the spotlight**

US cybersecurity firm CrowdStrike said its investigation into the recent bank hacks suggested the attacker likely used artificial intelligence tools and was potentially a 26-year-old based in Guangdong, China. The firm said the person used Anthropic’s Claude to conduct research and create a resume that likely belonged to the perpetrator, and may have used DeepSeek’s V4.1 Flash model along with tools from Z.ai and Elon Musk’s x.AI.

"This assessment is made with moderate confidence based on the use of the Chinese-developed tool ARTEX and observed Chinese-language prompts," CrowdStrike wrote in its report. "While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated."

CrowdStrike said the suspected attacker likely used a Hong Kong-based IP address to target Korean lenders. IP addresses linked to the hacks had hosted open directories containing Claude activity. The person also asked Claude to help find Korean data sales groups on the messaging app Telegram, the firm said. Claude is banned in China but can be accessed via virtual private networks.

On Oct. 4, South Korea’s Financial Services Commission said it had not found any evidence that financial account data was leaked to China, as reported by Bloomberg.

**Artex goes closed-source**

The Chinese AI cybersecurity tool Artex, which was designed to help organizations strengthen defenses through security testing, has been pulled from open access after being linked to the South Korean bank hacks.

The South Korean government said this week it was "highly likely" Artex had been used in data breaches at more than seven financial institutions. The tool's developer, "Autumn-27," wrote Thursday on code-hosting platform GitHub that Artex was "abused by some bad actors" to launch cyberattacks.

"Given the misuse of the tool, the Artex project will no longer be updated and will be converted to closed-source," the developer said. "No further versions will be released to the public, nor will maintenance support be provided."

Using Artex for cyberattacks was "entirely contrary to" the developer's intentions, they added, without referring directly to the alleged South Korean cases.

Experts told AFP that the decision would make the code harder for new users to obtain and adapt, but "cannot remove copies already downloaded or prevent people from continuing to use them," said Poe Zhao, founder of analysis publication Hello China Tech. Ilya Kulyatin, CEO of Foundry Labs and founder of the Tokyo AI tech community, said users of open-source programs can "remove restrictions built into the tool," which "makes certain forms of misuse easier," but that openness also benefits defenders.

**Broader implications**

In Japan, around 20 companies have said their data may have been compromised in a spate of similar cyberattacks potentially impacting millions of customers. The Japanese government has called on companies to strengthen their cyber defenses.

"At this stage, it is not clear what the background to these cases is or whether there are any links between them," Japan police chief Yoshinobu Kusunoki said on Thursday.

South Korean President Lee Jae Myung said on Tuesday that as AI makes hacking more sophisticated, "the scope of the damage is spreading across all areas on a scale that is difficult to compare with the past."

Rep. Song called for the prompt establishment of an AI-based defense system to address hacking attempts, stressing the need to develop technologies to identify attackers, as IP addresses can easily be concealed or disguised.