CrowdStrike says Korean financial-sector hack may be one person's work using open-source AI tool 'ARTEX' and several LLMs (community report)

What happened

This is based on a Reddit r/LocalLLaMA post that cited a CrowdStrike report. According to the post, last week's cyberattacks on major Korean financial companies may have been carried out by a single person. The attacker reportedly combined the open-source AI penetration-testing tool 'ARTEX' with DeepSeek V4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code. The original CrowdStrike report was not included in the materials collected for this briefing.

Provider claims

According to the post citing the CrowdStrike report, a single actor may have carried out the attacks by combining an open-source AI penetration tool with several commercial and open-weight models.

Why it matters

This follows today's briefing item on records of attackers' AI use. A security firm's analysis now suggests that one person, using open-source attack tools together with general-purpose LLMs, could attack multiple financial institutions in a row. This could directly affect AI security responses in the financial sector and discussions about how model providers control misuse.

Sources

• Community Last week some of South Korea's biggest banks were hit by a cyberattack. We now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code (CrowdStrike) Reddit

Story thread

1. 2026-10-07 'AI hacking' hits Korean financial firms: Yegaram and Welcome Savings Bank customer data leaked; no further damage confirmed at other members (report)
2. 2026-10-08 Suspect in serial hacks on Korean financial firms believed to be 26-year-old in Guangdong, China; AI usage records offer identity clues (report)
3. 2026-10-08 CrowdStrike says Korean financial-sector hack may be one person's work using open-source AI tool 'ARTEX' and several LLMs (community report)