CrowdStrike says suspect behind South Korea bank hacks may be 26-year-old in China
CrowdStrike said the suspect behind cyberattacks on South Korea's financial sector may be a 26-year-old based in China's Guangdong province, though it cautioned the details could not definitively identify the attacker.
US cybersecurity firm CrowdStrike published a report on its website on Wednesday saying the suspect behind recent cyberattacks targeting South Korea’s financial sector may be a 26-year-old based in China’s Guangdong province, according to Reuters.
CrowdStrike said it uncovered personal details linked to the suspected attacker while analysing AI coding-tool sessions and infrastructure tied to a campaign targeting South Korean financial institutions from late September to early October, Reuters reported. The attacker used ARTEX, a recently released Chinese-developed open-source penetration-testing tool, alongside large language models.
The report assessed with “moderate confidence” that the actor was a Chinese speaker and likely financially motivated. One Claude Code session contained a request to create a security researcher resume describing the results of the hacking activity; that prompt included a Telegram account, age, education background, and a location in Maoming, Guangdong. The same Telegram username appeared in other cyber activity, including vulnerability research involving a Telegram-based NFT marketplace and a separate suspected attack on a Chinese payment platform.
CrowdStrike said the personal details likely belonged to the actor responsible, but cautioned the available information could not definitively identify the attacker.
The report follows data breaches reported by Shinhan Bank and KB Kookmin Bank, a police probe, and President Lee Jae Myung’s remark on Tuesday that signs had emerged that AI was used in some of the incidents.
More on this topic: all Technology stories
