CrowdStrike says AI tools were used in suspected hacks of South Korean banks

In short: CrowdStrike reported that cyberattacks on South Korean financial institutions used a hacking tool called ARTEX and also used large language models.

What happened

CrowdStrike said it investigated cyberattacks targeting South Korean financial institutions that took place from late September to early October 2026. The company said the attacker used ARTEX, a Chinese-developed penetration-testing tool. Penetration-testing tools are often used by security teams to find weaknesses, but attackers can use the same tools like a set of lockpicks.

CrowdStrike also said the attacker used large language models, which are AI systems that can write and summarize text, like a very fast assistant. The report did not say exactly which AI models were used.

The firm said it had “moderate confidence” that the operator was likely Chinese-speaking and financially motivated. It pointed to Chinese-language prompts and the use of ARTEX. CrowdStrike also said files it reviewed suggested interest in online marketplaces and Telegram groups where stolen South Korean data could be sold.

CrowdStrike did not name a specific person or group behind the activity. The company said the attacker’s identity, the full scope of the intrusions, and how much data may have been stolen are still unconfirmed.

Why it matters

Banks and other financial firms hold sensitive information. Even if this case is not fully confirmed, it is a reminder that common tools, including AI writing tools, can help attackers move faster and plan attacks more easily. For customers, it is a reason to keep an eye on account alerts and to use protections like strong passwords and two-step verification (a second check, like a code sent to your phone).

Source: NYTimes