# Financial-Sector Hacker Estimated to Be 26 and from China’s Guangdong Province; Says His Phone Number Was Spoofed

> URL: https://www.cityhorror.wiki/en/ARTEX%EC%97%90-%EC%9D%B4%EC%96%B4-%EB%B6%99%EC%9D%B8-%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5%EC%9D%98-%EB%A8%B8%EB%A6%AC%EB%93%A4
> Estimated date: Sep 2026 ~ Oct 2026
> Last updated: 2026-10-28
> Korean original: https://www.cityhorror.wiki/ARTEX%EC%97%90-%EC%9D%B4%EC%96%B4-%EB%B6%99%EC%9D%B8-%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5%EC%9D%98-%EB%A8%B8%EB%A6%AC%EB%93%A4

## Overview

An analysis has found that the hacking attacks targeting South Korean financial institutions in succession from late September to early October 2026 involved ARTEX, an open-source penetration-testing tool developed in China, together with several large language models (LLMs). The attacker reportedly let an AI coding tool write a résumé and, in the process, revealed clues to his identity.

On October 7, 2026 (local time), U.S. cybersecurity firm CrowdStrike released a report describing evidence that the attacker had used ARTEX in combination with several LLMs, including DeepSeek. It then said the attacker might be a 26-year-old living in Guangdong, China. However, CrowdStrike stressed that this was only an inference based on circumstantial evidence, not a confirmed identity. The person identified as a possible suspect denied involvement in the hacking, saying his phone number had been used without his permission.

## Series of Intrusions at Financial Institutions

The incident came to light after breaches were confirmed in succession at seven financial institutions: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. According to financial authorities, the IP addresses used to attack commercial banks, savings banks, and a capital finance company were different. However, evidence suggested that the same attacker had changed IP addresses while using similar methods to target multiple financial institutions. The attacks were assessed as large-scale automated operations against multiple financial institutions using AI tools. Traces of ARTEX were found on an IP address used to attack a bank, prompting the National Police Agency’s Cyber Bureau to investigate.

Reports give varying figures for the scale of the damage. According to coverage relayed in a post on FM Korea, customer information belonging to about 25,000 people at Shinhan Bank and about 40,000 at Yegaram Savings Bank was leaked. Yonhap News reported that the exposure of around 100 items of customer information at KB Kookmin Bank through an external intrusion had been confirmed. The number of affected banks also varies: unlike the seven institutions confirmed by financial authorities, a Reuters report cited in the same post said at least nine banks had been targeted or otherwise affected.

## CrowdStrike’s Analysis

CrowdStrike assessed that the attacks took place from late last month to early this month, and that the attacker used ARTEX together with LLMs. The attacker directed the overall operation through a Hong Kong-based IP address used as the main control infrastructure. The ARTEX instance used in the attacks on South Korea operated in a two-stage setup from a separate IP address, and the attacker was found to have added nine proxy IP addresses to continually change the route used to connect.

The main AI used to run ARTEX was DeepSeek’s lightweight model, “v4.1-Flash.” The model was apparently accessed indirectly through a third-party reseller rather than through an official channel. The attacker also used other LLMs as auxiliary tools in Claude Code sessions, including Zhipu AI’s “GLM-5.3” and “Grok 4.6.” The apparent use of different models and servers for different purposes suggests that the attacker combined tools rather than relying on any one model or infrastructure. The attacker is believed to be a Chinese-language user, and the possibility of a financial motive was assessed with a moderate level of confidence.

On the 8th, Adam Meyers, head of counter adversary operations at CrowdStrike, held a video briefing with South Korean reporters to share the findings. News1 covered the report under the headline “South Korean Financial-Sector Hack Was Low-Level… Would Have Been Impossible Without AI.” Maeil Business Newspaper introduced the report under the headline “Couldn’t Stop It Because of AI? It Targeted Gaps Left Unaddressed by Financial Firms.” Read together, the two headlines convey that the attacks were not highly sophisticated but would have been impossible without AI, and that they targeted gaps left unaddressed by financial firms.

## Identity Clues Revealed in a Résumé

The identity clues emerged while the attacker was using Claude Code. According to a post on FM Korea, CrowdStrike investigators were tracking servers used in the attacks when they found a directory that had been exposed publicly. It reportedly contained Claude Code conversation logs and configuration files, allowing investigators to see what commands the attacker had given the AI.

According to CrowdStrike, the attacker asked Claude to write a résumé for a security researcher, including his penetration-testing achievements. In the process, he entered personal information such as his name initials, Telegram account, educational background, and place of residence. Maeil Business Newspaper reported this under the headline “Include My Experience Hacking Korean Financial Firms”… Chinese Man in His 20s Leaked ‘Hacking Clues’ While Having AI Write His Résumé.” It also emerged that the attacker had asked where stolen information from South Korean financial institutions was usually sold and how to find Korean-language Telegram groups selling data.

The report said that the Telegram account had also appeared in evidence related to other cyberattacks. The same account name was reportedly used in a session investigating a vulnerability in a Telegram-based NFT gift marketplace and in evidence of an attack targeting a Chinese payment platform. CrowdStrike cited this as a basis for suggesting the incidents might involve the same person, while adding that the information available so far was not enough to establish the person’s identity. A Reddit post on r/TechNadu also summarized the report, saying the suspected attacker may have exposed personal information through a Claude session while using ARTEX.

## Suspect’s Denial and Investigation

According to Yonhap News, the Chinese man identified as the suspected attacker claimed he had nothing to do with the hacking. He said he believed a hacker had used his mobile phone number without permission, and argued that the phone number was the only basis for identifying him as the attacker. He also said he was preparing to change his number after being inundated with messages.

A police official told Yonhap News, “We are investigating with all possibilities open,” adding, “Police investigations are based on evidence, and we are conducting an investigation to secure evidence.” According to the headline of a related News1 article, police expanded the financial institution hacking investigation team to 43 members. The headline of a related Yonhap News article said that a Korean-language version of ARTEX had surfaced and that its detection rules had been made public, while the headline of a related News1 article said the tool’s developer had made the source code private. According to the headline of another News1 article, the series of attacks also became an issue at a National Assembly audit of the Financial Services Commission, where Lee Eok-won said that the security response had been inadequate, prompting exchanges between the ruling and opposition parties.

## Authenticity Debate

The central question is whether the résumé and Telegram account clues presented by CrowdStrike are enough to identify a 26-year-old from Guangdong as the person behind the attacks.

### The Clues Are Considered Specific Enough

The evidence cited by CrowdStrike consists of the name initials, educational background, place of residence, and Telegram account entered together in the résumé. The same account name also appeared in a session investigating an NFT marketplace vulnerability and in evidence related to an attack on a Chinese payment platform. CrowdStrike cited these intersecting clues as grounds for suggesting that the incidents might involve the same person.

While composing the résumé, the attacker asked where South Korean financial information was sold. CrowdStrike assessed the possibility of a financial motive with a moderate level of confidence. It also said these records were found in Claude Code conversation logs and configuration files left in a publicly accessible directory on a server used in the attacks.

### It Is Too Early to Confirm the Identity

CrowdStrike itself stressed that its findings were only an inference based on circumstantial evidence, adding that the information available so far was not enough to confirm the person’s identity. The man identified as a suspect denied the allegations, saying his phone number had been used without permission and that the number was the only basis for identifying him. Police also said they were keeping all possibilities open while gathering evidence.

The attacker was found to have changed connection routes using a Hong Kong server, nine proxy IP addresses, and even a third-party reseller.

The attacker’s identity has not yet been confirmed.

## Trivia

- A post on FM Korea included what appeared to be a screenshot of ARTEX’s administration interface. The screen showed a dashboard displaying LLM token usage. The post noted that the hacker had not properly secured his own server.
- As Maeil Business Newspaper’s headline put it, the attacker asked the AI to include “experience hacking Korean financial firms” in his résumé. In other words, he had the AI tool he used for the attacks turn those attacks into résumé experience.

## Sources

- FM Korea post, [“Domestic Banks Used as a 26-Year-Old Chinese Man’s Résumé Experience”](https://m.fmkorea.com/best/10428687173)
- CrowdStrike, [“Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance”](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) (2026-10-07)
- Yonhap News, [“Suspected Financial-Sector Hacker Is 26-Year-Old From Guangdong, China… Says His Number Was Stolen (2nd Update)”](https://www.yna.co.kr/view/AKR20261008020053017) (2026-10-08)
- Maeil Business Newspaper, [“Couldn’t Stop It Because of AI? It Targeted Gaps Left Unaddressed by Financial Firms”… What the Report on the Series of Hacks Reveals](https://www.mk.co.kr/article/12172126) (2026-10-09)
- News1, [“South Korean Financial-Sector Hack Was Low-Level… Would Have Been Impossible Without AI”](https://www.news1.kr/it-science/security-hacking/6314869) (2026-10-08)
- Reddit r/TechNadu, [“CrowdStrike says suspected South Korean bank attacker ...”](https://www.reddit.com/r/TechNadu/comments/1x0lgsx/crowdstrike_says_suspected_south_korean_bank/)

## Verified facts

- Between late September and early October 2026, breaches were confirmed at seven financial companies: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. This was reported by Yonhap News and shown in a screenshot in the FMKorea post.
- The U.S. cybersecurity company CrowdStrike released an analysis report on October 7, 2026 (local time). The report was titled “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance.” This is confirmed by CrowdStrike’s blog and Yonhap News.
- The attacker was assessed to have used ARTEX, an open-source agentic penetration-testing tool developed in China, together with several large language models (LLMs). Yonhap News and the FMKorea post covered this, and the CrowdStrike report title and News1 coverage also refer to the use of AI.
- The attacker was suspected to be a 26-year-old individual living in Guangdong Province, China. This is reported by Yonhap News, a News1 interview with CrowdStrike, and the FMKorea post. Yonhap News noted that this did not amount to a definitive identification.
- A clue to the person’s identity was exposed while the attacker was using the AI coding tool Claude Code. The attacker entered personal information while asking Claude to write a résumé for a security researcher. This was covered by Yonhap News and the FMKorea post, as well as by the headline of a Maeil Business Newspaper article: “Add Experience Hacking Korean Financial Firms… Clues to the Hack Leaked While Writing an AI Résumé.” A Reddit post also said personal information may have been exposed through a Claude session.
- CrowdStrike considered it possible that the attacker was a Chinese speaker and was financially motivated. Yonhap News reported that CrowdStrike assigned this assessment a moderate confidence level; the same points were made in a News1 interview during a CrowdStrike briefing.
- According to Yonhap News, the attacker primarily used DeepSeek and also used GLM and Grok as supplementary tools in Claude Code sessions. The FMKorea post likewise said that the attacker used several LLMs, including DeepSeek, GLM, and Grok.
- According to Yonhap News and the FMKorea post, customer information was leaked at Shinhan Bank and KB Kookmin Bank. The FMKorea post said reports indicated that information belonging to about 25,000 people at Shinhan Bank and about 40,000 at Yegaram Savings Bank had been leaked. Yonhap News reported that the leak of around 100 records of KB Kookmin Bank customer information had been confirmed.
- South Korean police are investigating the case. Yonhap News reported that the National Police Agency’s Cyber Investigation Bureau was investigating and quoted a police official as saying, “We are investigating with all possibilities open.” The headline of a related News1 article said the investigation team had been expanded to 43 members.

## Points of dispute

- Accounts differ on the scale of the incident. Yonhap News said breaches had been confirmed at seven financial companies, while the FMKorea post, citing Reuters, said at least nine banks had been targeted or affected.
- There is disagreement over whether the identified individual was the attacker. CrowdStrike only raised the possibility based on circumstantial evidence and did not conclusively identify the person. According to Yonhap News, the man identified said his phone number had been spoofed and denied involvement in the hacking.
- The FMKorea post said the hacker left a publicly accessible directory exposed, revealing Claude Code conversation logs and configuration files. Yonhap News did not cover this and reported only that personal information was exposed during the résumé-writing process, so this claim is supported by that source alone.