Hackers Use Claude, DeepSeek and Grok in AI-Assisted Attacks on South Korean Banks

Hackers linked to attacks on South Korean banks used Claude Code, DeepSeek, Grok, and Zhipu AI alongside ARTEX, an open-source AI penetration testing framework.

The campaign shows how attackers can combine AI services with familiar hacking tools to search for weaknesses across different systems, while leaving evidence that helps investigators trace their work.

Public reporting cited in the investigation said the breaches exposed personal information belonging to at least 68,000 people across at least seven financial institutions.

The wider South Korean banking investigation followed disclosures involving different services and types of data, rather than one shared weakness affecting every bank.

Researchers from Recorded Future’s Insikt Group identified tools for stealing cryptocurrency wallet files, expanding access to Linux systems, and testing mobile devices.

In its October 16 report, the team tracked the actor as TAG-217 and showed that preparations began in August, weeks before the banking attacks became public. The report does not identify a single named malware family behind every intrusion.

Hackers Use Claude, DeepSeek and Grok in AI-Assisted Attacks

ARTEX is a Chinese-language framework built for automated security testing. Industry sources linked it to the banking attacks, while public analysis on October 7 identified the operator’s use of several AI tools.

Recorded Future described the actor as a suspected Chinese speaker, not as a confirmed state-backed group. Earlier reporting on agentic AI bank breaches described exposed Claude Code sessions, ARTEX settings, and AI memory files.

These records help explain the workflow, but they do not establish that AI acted without human direction. Recorded Future also said the available evidence cannot measure how much AI accelerated the attacks.

The attacker used residential proxies to route traffic through ordinary internet connections, likely to hide its origin.

This could make activity harder to separate from normal users. However, open directories on attacker infrastructure exposed files and logs, allowing researchers to connect servers, scripts, and earlier preparations.

Preparations Began Before the Bank Breaches

Between August 17 and August 22, TAG-217 tested remote-access infrastructure and scanned internet-facing systems. Logs showed repeated connections between its own servers.

Crucially, those records did not demonstrate successful access to victims, so the tests should not be treated as confirmed breaches.

By August 22, the actor had assembled tools targeting cryptocurrency mining operations running YiiMP. Their features included trying default passwords, stealing wallet configuration and key files, maintaining remote access, and sending Telegram alerts after capturing credentials.

Other tools targeted known Linux weaknesses to increase privileges or extract protected password data after an initial compromise.

By September 5, TAG-217 had created a workspace for testing iPhone weaknesses and changing Android system software. Again, the logs showed experiments, not proven mobile compromises.

By September 26, its environment contained AI tools and records covering reconnaissance, proxy traffic, payload delivery, and checks involving payment processes. The operator also prepared ways to keep servers connected and copy AI working-memory files between them.

This broader use of Claude AI agent workflows reflects a shift from asking chatbots isolated questions toward using AI within ongoing technical tasks. It does not mean every tool found was used against a South Korean bank.

The distinction matters when assessing risk. Finding a wallet-stealing script shows that an attacker prepared a capability; it does not prove that a bank lost cryptocurrency.

Likewise, finding mobile testing files does not establish that customer phones were infected. The strongest findings concern the exposed preparation records and the operator’s wider technical interests.

For financial institutions, the immediate priority is reducing exposure around sensitive records. Recorded Future recommends identifying internet-accessible services, checking access permissions, and fixing weaknesses according to the data and systems at risk.

Employee and partner applications need the same attention as customer-facing services because both can provide access to valuable information.

Security teams should connect infrastructure intelligence with unusual sign-ins, repeated requests for different customers’ records, unexpected remote access, and abnormal transfers.

These signals can reveal related activity even when attackers change proxy addresses. Automated responses should remain proportionate: confirmed malicious sessions can be stopped, while uncertain findings need review before actions disrupt customers or shared services.

TAG-217’s exposed files show the limits of AI-assisted attacks. The tools broadened the operator’s options, but basic security mistakes still left a trail. Defenders should focus on closing known gaps and linking evidence quickly, rather than assuming AI has made familiar controls useless.

Indicators of compromise (IoCs):-

Indicator type	Availability in the source
SHA-256, SHA-1, and MD5 hashes	Not published in the public report
Attacker IP addresses	No explicit values published
Malicious domains and URLs	No explicit values published
Detailed campaign IoCs	Referenced in the customer intelligence-platform note

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team