Financially motivated group used AI tools including Claude Code, DeepSeek and Grok in South Korean bank attacks
AI SECURITYClaude Coderedteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A financially motivated threat actor used ARTEX, Claude Code and multiple large language models, including DeepSeek and Grok, in intrusions against South Korean financial organisations that resulted in data theft between late September and early October 2026. Exposed attacker directories contained session histories, configurations and operational scripts that documented the AI-assisted tradecraft. The article does not give CVE IDs, affected versions or indicators, and it is truncated before the findings of CrowdStrike's 7 October investigation. Defenders should check the full CrowdStrike report for indicators.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies
Products