South Korea's financial sector faced coordinated cyberattacks against at least seven institutions between late September and early October. Security firm CrowdStrike traced the intrusions to Chinese origins and identified the use of AI models DeepSeek v4.1-flash and Grok 4.6 combined with ARTEX, a Chinese open-source tool that deploys AI agents for penetration testing.
The attacks exposed customer data including names, phone numbers, and annual income. Whether funds were actually withdrawn remains unclear. This incident underscores how AI tools—both legitimate and repurposed—are becoming attack vectors in sophisticated financial sector breaches, with attackers leveraging automation to scale their reconnaissance and exploitation efforts across multiple targets simultaneously.