CrowdStrike’s October 7 analysis says an attacker used ARTEX penetration-testing software and large language models against South Korean financial organisations in late September and early October. Researchers found tool configuration and Claude Code session histories in attacker-controlled open directories.
The firm assessed with moderate confidence that the actor was likely a Chinese speaker and financially motivated. It did not establish a definitive identity, named group or confirmed number of affected organisations.
This is the security firm’s investigation, not proof that every attack step was autonomous or that AI providers’ own systems were breached. BleepingComputer covered the findings on October 10. Sources: CrowdStrike, October 7; BleepingComputer, October 10.