Claude Code traces highlight 26-year-old suspect in South Korea attacks

The attacks unfolded from late September into early October, when a series of data leaks struck multiple South Korean financial institutions. According to Reuters, at least 9 banks were identified as targets through victim disclosures and local news coverage. CrowdStrike investigated the campaign and found an openly browsable directory on a server linked to IP addresses used in the attacks. It contained Claude Code usage records and ARTEX configuration files, suggesting the attacker pursued targets between late September and early October that overlapped with the institutions already reported as victims.

The tooling points to a deliberately assembled setup. ARTEX, published on GitHub in 2026 by a Chinese security engineer, connects to external LLMs such as ChatGPT and Claude to hunt for vulnerabilities, letting the user choose which model to use. In this campaign the operator leaned on DeepSeek v4.1-flash, along with GLM-5.3 from Zhipu AI and Grok 4.6 from xAI. CrowdStrike says the attacker split work across two servers, using a Hong Kong-based server as the core of the attack infrastructure and another to run ARTEX, which also held Chinese-language documents instructing the linked LLMs on how to proceed. Activity was routed through nine additional proxy IP addresses.

CrowdStrike has not identified the attacker, estimating with moderate confidence that he is a Chinese speaker and likely motivated by money, based on his use of the Chinese-origin ARTEX and Chinese-language prompts. Adam Myers, who oversees attacker tracking and analysis at CrowdStrike, framed the case as an example of a human attacker using AI agents to attack at breadth, saying that AI has made it possible for one person to target many victims in a very short time. ARTEX's public page limits its use to personal study and code research and asks users not to run penetration tests against live systems or websites.