🤖 AI-assisted intrusion chain exposed in South Korean bank attacks

A Chinese-speaking threat actor used ARTEX AI and Claude agents in attacks against multiple South Korean banks, including Shinhan, KB Kookmin, and Hana. CrowdStrike traced open directories containing Claude session histories, ARTEX configs, and memory files, linking the infrastructure to breaches that exposed customer data and in some cases disrupted systems.

The case shows agentic tooling moving from lab-grade pentest automation into operational intrusion support. It also highlights a recurring OPSEC failure: AI workflow artifacts can preserve target lists, tool settings, and operator traces that materially improve attribution and incident reconstruction.

🛰️ Open sources - closed narratives
@sitreports