Financial-Sector Hacker Estimated to Be 26 and from China’s Guangdong Province; Says His Phone Number Was Spoofed

1. Overview

An analysis has found that the hacking attacks targeting South Korean financial institutions in succession from late September to early October 2026 involved ARTEX, an open-source penetration-testing tool developed in China, together with several large language models (LLMs). The attacker reportedly let an AI coding tool write a résumé and, in the process, revealed clues to his identity.

On October 7, 2026 (local time), U.S. cybersecurity firm CrowdStrike released a report describing evidence that the attacker had used ARTEX in combination with several LLMs, including DeepSeek. It then said the attacker might be a 26-year-old living in Guangdong, China. However, CrowdStrike stressed that this was only an inference based on circumstantial evidence, not a confirmed identity. The person identified as a possible suspect denied involvement in the hacking, saying his phone number had been used without his permission.

2. Series of Intrusions at Financial Institutions

The incident came to light after breaches were confirmed in succession at seven financial institutions: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. According to financial authorities, the IP addresses used to attack commercial banks, savings banks, and a capital finance company were different. However, evidence suggested that the same attacker had changed IP addresses while using similar methods to target multiple financial institutions. The attacks were assessed as large-scale automated operations against multiple financial institutions using AI tools. Traces of ARTEX were found on an IP address used to attack a bank, prompting the National Police Agency’s Cyber Bureau to investigate.

Reports give varying figures for the scale of the damage. According to coverage relayed in a post on FM Korea, customer information belonging to about 25,000 people at Shinhan Bank and about 40,000 at Yegaram Savings Bank was leaked. Yonhap News reported that the exposure of around 100 items of customer information at KB Kookmin Bank through an external intrusion had been confirmed. The number of affected banks also varies: unlike the seven institutions confirmed by financial authorities, a Reuters report cited in the same post said at least nine banks had been targeted or otherwise affected.

3. CrowdStrike’s Analysis

CrowdStrike assessed that the attacks took place from late last month to early this month, and that the attacker used ARTEX together with LLMs. The attacker directed the overall operation through a Hong Kong-based IP address used as the main control infrastructure. The ARTEX instance used in the attacks on South Korea operated in a two-stage setup from a separate IP address, and the attacker was found to have added nine proxy IP addresses to continually change the route used to connect.

The main AI used to run ARTEX was DeepSeek’s lightweight model, “v4.1-Flash.” The model was apparently accessed indirectly through a third-party reseller rather than through an official channel. The attacker also used other LLMs as auxiliary tools in Claude Code sessions, including Zhipu AI’s “GLM-5.3” and “Grok 4.6.” The apparent use of different models and servers for different purposes suggests that the attacker combined tools rather than relying on any one model or infrastructure. The attacker is believed to be a Chinese-language user, and the possibility of a financial motive was assessed with a moderate level of confidence.

On the 8th, Adam Meyers, head of counter adversary operations at CrowdStrike, held a video briefing with South Korean reporters to share the findings. News1 covered the report under the headline “South Korean Financial-Sector Hack Was Low-Level… Would Have Been Impossible Without AI.” Maeil Business Newspaper introduced the report under the headline “Couldn’t Stop It Because of AI? It Targeted Gaps Left Unaddressed by Financial Firms.” Read together, the two headlines convey that the attacks were not highly sophisticated but would have been impossible without AI, and that they targeted gaps left unaddressed by financial firms.

4. Identity Clues Revealed in a Résumé

The identity clues emerged while the attacker was using Claude Code. According to a post on FM Korea, CrowdStrike investigators were tracking servers used in the attacks when they found a directory that had been exposed publicly. It reportedly contained Claude Code conversation logs and configuration files, allowing investigators to see what commands the attacker had given the AI.

According to CrowdStrike, the attacker asked Claude to write a résumé for a security researcher, including his penetration-testing achievements. In the process, he entered personal information such as his name initials, Telegram account, educational background, and place of residence. Maeil Business Newspaper reported this under the headline “Include My Experience Hacking Korean Financial Firms”… Chinese Man in His 20s Leaked ‘Hacking Clues’ While Having AI Write His Résumé.” It also emerged that the attacker had asked where stolen information from South Korean financial institutions was usually sold and how to find Korean-language Telegram groups selling data.

The report said that the Telegram account had also appeared in evidence related to other cyberattacks. The same account name was reportedly used in a session investigating a vulnerability in a Telegram-based NFT gift marketplace and in evidence of an attack targeting a Chinese payment platform. CrowdStrike cited this as a basis for suggesting the incidents might involve the same person, while adding that the information available so far was not enough to establish the person’s identity. A Reddit post on r/TechNadu also summarized the report, saying the suspected attacker may have exposed personal information through a Claude session while using ARTEX.

5. Suspect’s Denial and Investigation

According to Yonhap News, the Chinese man identified as the suspected attacker claimed he had nothing to do with the hacking. He said he believed a hacker had used his mobile phone number without permission, and argued that the phone number was the only basis for identifying him as the attacker. He also said he was preparing to change his number after being inundated with messages.

A police official told Yonhap News, “We are investigating with all possibilities open,” adding, “Police investigations are based on evidence, and we are conducting an investigation to secure evidence.” According to the headline of a related News1 article, police expanded the financial institution hacking investigation team to 43 members. The headline of a related Yonhap News article said that a Korean-language version of ARTEX had surfaced and that its detection rules had been made public, while the headline of a related News1 article said the tool’s developer had made the source code private. According to the headline of another News1 article, the series of attacks also became an issue at a National Assembly audit of the Financial Services Commission, where Lee Eok-won said that the security response had been inadequate, prompting exchanges between the ruling and opposition parties.

6. Authenticity Debate

The central question is whether the résumé and Telegram account clues presented by CrowdStrike are enough to identify a 26-year-old from Guangdong as the person behind the attacks.

6.1. The Clues Are Considered Specific Enough

The evidence cited by CrowdStrike consists of the name initials, educational background, place of residence, and Telegram account entered together in the résumé. The same account name also appeared in a session investigating an NFT marketplace vulnerability and in evidence related to an attack on a Chinese payment platform. CrowdStrike cited these intersecting clues as grounds for suggesting that the incidents might involve the same person.

While composing the résumé, the attacker asked where South Korean financial information was sold. CrowdStrike assessed the possibility of a financial motive with a moderate level of confidence. It also said these records were found in Claude Code conversation logs and configuration files left in a publicly accessible directory on a server used in the attacks.

6.2. It Is Too Early to Confirm the Identity

CrowdStrike itself stressed that its findings were only an inference based on circumstantial evidence, adding that the information available so far was not enough to confirm the person’s identity. The man identified as a suspect denied the allegations, saying his phone number had been used without permission and that the number was the only basis for identifying him. Police also said they were keeping all possibilities open while gathering evidence.

The attacker was found to have changed connection routes using a Hong Kong server, nine proxy IP addresses, and even a third-party reseller.

The attacker’s identity has not yet been confirmed.

7. Trivia

• A post on FM Korea included what appeared to be a screenshot of ARTEX’s administration interface. The screen showed a dashboard displaying LLM token usage. The post noted that the hacker had not properly secured his own server.
• As Maeil Business Newspaper’s headline put it, the attacker asked the AI to include “experience hacking Korean financial firms” in his résumé. In other words, he had the AI tool he used for the attacks turn those attacks into résumé experience.