CrowdStrike links "YY" AI logs to bank attacks

The CrowdStrike report traces a specific investigative path rather than a single breach. Researchers examined an exposed directory on a server tied to the attacks, and a Chinese-language instruction file led them to a second server in Hong Kong, where they found session histories, configuration files, and AI memory files documenting the targeting. That trail is what surfaced the prompt named "YY" — a resume-writing request listing a Chinese university and a location in Guangdong, with conflicting age information of 26 and an initial birth date in September 2007.

The same resume prompt included a Telegram username that also appeared in activity targeting a possible Chinese payment platform and in Claude Code sessions seeking vulnerabilities in a Telegram-based NFT gift marketplace. CrowdStrike says the details likely belong to the attacker but that it cannot definitively establish that connection, and police are still investigating whether an individual or an organized group carried out the attacks. The reported customer counts — about 25,000 at Shinhan Bank, along with 119 at KB Kookmin and 89 at Hana — sit alongside the pending October 19 parliamentary audit of the five major commercial banks.