The intrusions targeted at least nine banks, including Shinhan, KB Kookmin, and Hana Bank, exposing data of 68,000 customers. CrowdStrike attributed the attacks to a 26 year old financially motivated operator in China who combined ARTEX with Claude Code and Grok 4.6. The attacker was identified after leaving his own server open, exposing session logs and an AI-generated resume containing his personal identity and location in Guangdong. The developer of ARTEX subsequently took the tool closed source after the breaches.
Wednesday, October 21, 2026
Story
Korea's Top Bank CEOs Face Parliament Over Missed AI Attack Warning
Cybersecurity10 days ago
Documents from the Financial Security Institute reveal South Korea warned financial firms of AI agent attacks on Sept. 17, about two weeks before the ARTEX tool was used to breach multiple institutions. This briefing, attended by about 160 security officials, disclosed the country's first confirmed AI agent intrusion involving a DeepSeek-based tool used to exploit Oracle WebLogic systems. The CEOs of South Korea's five largest banks are now due before parliament on Oct. 19 to answer for security failures that left banks vulnerable to these campaigns.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.