Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says

A sophisticated cyber‑attack on several South Korean financial institutions has been linked to a hacker who employed an artificial‑intelligence tool developed in China, according to a statement released by the cybersecurity firm CrowdStrike on Monday. The firm, which monitors and analyses global threat activity, said the attacker targeted the banks’ internal networks in order to steal data and potentially facilitate fraudulent transactions. While the investigation points to a Chinese‑speaking individual acting for financial gain, CrowdStrike stopped short of naming a specific group or attributing the operation to any state‑backed actor.The intrusion, which began in early July, was detected by the banks’ own security operations centres after unusual outbound traffic was observed from servers that host critical banking applications..

CrowdStrike was engaged after the banks reported the anomaly, and its analysts were able to trace the malicious activity back to a custom‑built AI model that automates the discovery of vulnerable systems and the generation of phishing lures. According to the firm, the tool leverages natural‑language processing and pattern‑recognition algorithms that were originally designed for legitimate business analytics in China, but have been repurposed for illicit purposes.In its technical briefing, CrowdStrike outlined how the AI‑driven instrument was used to scan public‑facing websites and employee social‑media profiles to harvest credentials. The tool then created highly convincing spear‑phishing emails, embedding malicious attachments that, when opened, deployed a remote access trojan capable of bypassing two‑factor authentication..

Once inside the banks’ networks, the attacker moved laterally, exploiting unpatched Windows servers and outdated third‑party software to gain elevated privileges. The firm’s investigators found evidence that the intruder exfiltrated transaction logs, customer records and internal communications over a period of several weeks.The banks involved, which include three of South Korea’s largest commercial banks, have not been identified by name in the public domain, but they confirmed that the breach was contained and that no customer funds were directly compromised. In a joint press release, the institutions said they had taken “immediate remedial actions” to patch vulnerable systems, reset affected accounts and enhance monitoring for any signs of continued activity..

They also emphasized that their cooperation with law‑enforcement agencies and private security firms would continue until the full scope of the intrusion was understood.CrowdStrike’s analysis suggests that the attacker’s primary motivation was financial, rather than espionage. The firm highlighted the pattern of data theft, which focused on proprietary banking software and internal audit reports, as well as the timing of the breach, which coincided with a period of heightened market volatility in the region. By extracting this information, the hacker could potentially sell it on the dark web to other criminal groups or use it to facilitate fraudulent loan applications and wire transfers..

The company noted that the use of a Chinese‑origin AI tool does not automatically implicate any nation‑state, but it does raise concerns about the dual‑use nature of emerging technologies.Security experts warn that the incident underscores a growing trend in which artificial intelligence is being weaponised to automate and scale traditional cyber‑crime techniques. “We are seeing a shift from manually crafted phishing campaigns to AI‑generated content that can adapt in real time to the target’s language and behaviour,” said Dr Helen Kim, a professor of cybersecurity at Seoul National University. “This not only increases the success rate of attacks but also reduces the time and expertise required for low‑skill actors to launch sophisticated operations.” She added that regulators in Asia are beginning to grapple with the implications of AI‑enabled threats, with several jurisdictions proposing new guidelines for the responsible development and distribution of advanced machine‑learning models.The South Korean government has responded by convening a multi‑agency task force to investigate the breach and to assess the broader risk posed by AI‑powered cyber‑tools..

In a statement, the Ministry of Science and ICT said it would work closely with industry partners to develop a national framework for the detection and mitigation of AI‑based threats. The ministry also indicated that it would seek to engage with international counterparts, including the United States and the European Union, to share threat intelligence and to coordinate a response to the illicit use of AI technology across borders.Meanwhile, Chinese authorities have not commented on the allegations that a domestically developed AI tool was used in the attack. The Chinese Ministry of Industry and Information Technology, when queried, referred the matter to relevant regulatory bodies and reiterated its commitment to “preventing the misuse of emerging technologies.” Analysts note that the lack of a public response is not unusual, given the diplomatic sensitivities surrounding cyber‑security accusations between the two nations.The incident has also sparked debate within the cybersecurity community about the responsibility of AI developers to implement safeguards against malicious repurposing..

Some experts argue that companies should embed “ethical use clauses” and technical controls, such as watermarking of model outputs, to deter abuse. Others caution that overly restrictive measures could stifle innovation and limit legitimate commercial applications. The balance between fostering technological advancement and protecting critical infrastructure remains a contentious issue.Financial regulators in South Korea have called for a review of existing cybersecurity standards for banking institutions, urging them to adopt more robust AI detection capabilities..

In a recent conference, the Financial Services Commission highlighted the need for banks to conduct regular red‑team exercises that simulate AI‑driven attacks, and to invest in threat‑hunting platforms capable of analysing anomalous behaviour in real time. The commission also suggested that banks collaborate on shared intelligence platforms to collectively defend against sophisticated threat actors.As the investigation continues, law‑enforcement agencies in both South Korea and the United States have opened parallel inquiries into the potential criminal networks behind the breach. The FBI’s cyber‑crime division has issued an advisory warning that similar AI‑enhanced phishing techniques have been observed targeting financial entities in other regions, and it has urged organizations to review their email security protocols..

In Seoul, the National Police Agency’s cyber‑crime unit has pledged to pursue any individuals or groups responsible, and to work with international partners to trace the flow of stolen data.The CrowdStrike report concludes with recommendations for organisations worldwide to bolster their defences against AI‑augmented threats. Key measures include implementing strict access controls, maintaining up‑to‑date patch management cycles, employing multi‑factor authentication that resists credential‑theft, and deploying advanced anomaly detection systems that can flag AI‑generated content. The firm also advises businesses to conduct regular training for employees on recognizing sophisticated phishing attempts, noting that human vigilance remains a critical line of defence even as technology evolves.In the wake of the breach, South Korean banks have reaffirmed their commitment to protecting customers’ assets and data, while also acknowledging that the cyber‑security landscape is changing rapidly.