Description: An unidentified attacker reportedly used ARTEX, an AI-powered security-testing tool, alongside large language models to breach South Korean financial institutions and steal data. Compromised systems included a loan-broker inquiry service and an employee mobile work-support system. Researchers linked the activity to exposed attacker infrastructure and AI session histories. The attacker’s identity and the full number of affected institutions remained unconfirmed.
Entities
View all entitiesAlleged: AI agent system developers , Large language model developers , ARTEX developers , Autumn-27 , DeepSeek , Zhipu AI , xAI and Anthropic developed an AI system deployed by Cybercriminals , hackers , Threat actors , Agentic threat actors and AI agent system deployers, which harmed Shinhan Bank , KB Kookmin Bank , Financial institutions , Bank customers , Banks , Privacy , Information integrity , General public , General public of South Korea and Customers.
Alleged implicated AI systems: DeepSeek , ARTEX , Claude Code , DeepSeek v4.1-flash , GLM-5.3 , Grok 4.6 , Grok , AI agent systems , AI penetration testing systems , Large language models and Anthropic large language models
Incident Stats
Incident ID
1782
Report Count
1
Incident Date
2026-09-27
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analys…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
Similar Incidents
Did our AI mess up? Flag the unrelated incidents
Similar Incidents
Did our AI mess up? Flag the unrelated incidents