South Korea’s Bank Hacks: Attackers Ran the Agentic Pentest First
An AI pentesting agent was linked to at least two of the South Korean bank hacks. Here’s what is reported, what is inferred, and why your own agent should get there first.
TL;DR
- An AI agent was linked to at least two breaches. CrowdStrike tied a campaign against Korean banks to ARTEX, an open-source agentic pentesting tool developed in China. It describes two affected banks by system type, names none, and says the full count is unconfirmed.
- Side doors, not the vault. The reported entry points were a lookup service for loan brokers, employee mobile apps, and a sales-support system. No customer financial losses or stolen passwords have been confirmed (American Banker).
- Old flaws, new speed. Attackers got past a phone-verification step, exploited weak session checks, and fed customer numbers into lookup services. No CVE has been named.
- Detection took up to three days. The banks needed 15 to 68 hours to detect the intrusions (Korea JoongAng Daily). One attack ran for more than 40 hours (SBS).
- Regulators want every exposed system checked. Korea’s Financial Services Commission ordered banks to list every externally exposed system and close any path to internal data that skips authentication (SBS).
Between late September and early October 2026, attackers breached seven South Korean banks and lenders, including Shinhan Bank and KB Kookmin Bank (Korea JoongAng Daily). Where entry points were disclosed, they were internet-facing tools built for loan brokers and employees, protected by weak authentication. CrowdStrike linked attacks on two unnamed banks to ARTEX, an open-source AI pentesting agent run by a human operator. Which of the seven involved ARTEX is partly inference, as the table below shows.
The lesson for every bank and fintech: attackers already run agentic pentests against your web apps. Run yours first.
What is agentic pentesting?
Agentic pentesting, also called agentic penetration testing, is a form of AI penetration testing. AI agents plan and run the individual steps on their own, such as probing logins, trying requests, and chaining what they find. A human sets the target and scope and reviews the results. In a manual pentest, a person decides each step.
What is ARTEX?
ARTEX is “a recently released open-source agentic penetration testing (pentesting) tool developed in China,” per CrowdStrike. It runs on large language models; in this campaign, a human operator directed it. Its developer closed the source after the Korean attacks, but English- and Korean-language derivatives already exist (BleepingComputer).
What happened in the South Korea bank hacks?
Seven Korean banks and lenders reported data leaks in about a week. Woori Bank and NH NongHyup Bank also reported attacks, but no information was exposed (The Korea Times).
| Firm | Entry point | Data exposed | AI link reported | Source |
|---|---|---|---|---|
| Yegaram Savings Bank | Server holding customer data | About 40,000 customers: names, dates of birth, contact details | No public AI link reported | SBS, Korea JoongAng Daily |
| Shinhan Bank | Lookup service for loan brokers | About 25,700 customers: names, phone numbers, annual income, loan limits | Reported: ARTEX-matching page title on a server tied to the attack | SBS, Korea JoongAng Daily, American Banker, The Korea Times |
| KB Kookmin Bank | Employee mobile work-support system | 119 people (99 customers, 20 employees): names, phone numbers, addresses, encrypted resident registration numbers | Our inference: system type matches one CrowdStrike describes | SBS, Korea JoongAng Daily, The Korea Times |
| Hana Bank | Sales-support system | 89 customers: resident registration numbers, names, addresses, emails, phone numbers, workplaces | Suspected: repeated attempts pointed to automation | The Korea Times, Korea JoongAng Daily |
| BNK Busan Bank | Employee sales-support web pages with insufficient session validation | 11 outsourced developers | Bank says: an AI agent was used | SBS, American Banker, Korea JoongAng Daily |
| Welcome Savings Bank | Not disclosed | Up to 2,200 corporate customer records | No public AI link reported | Korea JoongAng Daily |
| Hyundai Capital | Not disclosed | Data on some of its 146 mortgage loan agents | No public AI link reported | Korea JoongAng Daily |
How to read “AI link reported”: it shows the evidence level for each firm. CrowdStrike describes two affected banks by system type and names none, so matching a firm to its description is our inference. BleepingComputer, in its own voice, lists Shinhan, KB Kookmin, and Hana among the operator’s targets. Welcome Savings Bank and Hyundai Capital have not disclosed entry points.
| Date (2026) | Event | Source |
|---|---|---|
| Sep 27 | Attack on KB Kookmin’s employee mobile system begins; it runs for more than 40 hours | SBS |
| Sep 29 | Shinhan detects an attack on its loan-broker service; attacks continue into the next day | SBS |
| Sep 30 | Financial Supervisory Service opens an on-site inspection at Shinhan; KB confirms its leak | SBS, SBS |
| Oct 1 | Shinhan discloses the breach; regulators send five attack IPs to about 500 financial firms | SBS, The Asia Business Daily |
| Oct 2 | Financial Services Commission orders checks of every externally exposed system | SBS |
| Oct 6 | President Lee Jae Myung says signs of AI use have emerged; regulators count 33 attack IPs | American Banker, The Asia Business Daily |
| Oct 7 | CrowdStrike ties the campaign to ARTEX | CrowdStrike |
| Oct 8 | ARTEX’s developer closes the source and stops updates | Forkast |
The AI link surfaced in two steps. A Korean security researcher, cited by Yonhap, spotted an ARTEX-matching page title on a server tied to the Shinhan attack (American Banker). CrowdStrike then found the operator’s session logs, memory files, and ARTEX configs in open directories on the attacker’s own servers.
CrowdStrike assesses, with moderate confidence, that the operator is a financially motivated Chinese speaker. It describes two affected banks by system type, names none, and calls the number of affected organizations unconfirmed. No Korean regulator has publicly named ARTEX (American Banker).
How did attackers use AI to breach the banks?
Reports describe attackers using AI to do a pentester’s job at machine speed, against tools the banks had left reachable from the internet. A human still ran the operation: a Financial Security Institute official said the AI “did not act independently without human involvement” (American Banker). Steps 1 and 5 below come from CrowdStrike’s analysis of the ARTEX operator. Steps 2 to 4 come from reporting on the breaches, where an AI link is reported but not confirmed for every firm.
- Orchestrate. The ARTEX instance used DeepSeek v4.1-flash as its main model. The operator added GLM-5.3 and Grok 4.6 in Claude Code sessions, steered by a Chinese-language pentesting prompt (CrowdStrike).
- Find the side doors. The targets were internet-facing internal tools: a lookup service for loan brokers, employee mobile apps, and a sales-support system (SBS).
- Get past the login. At Shinhan, the attacker got past a mobile-phone verification step. BNK Busan cited insufficient session validation on some web pages (American Banker).
- Pull the records. The attacker obtained customer numbers and fed them into five or six of Shinhan’s simple inquiry services to extract more data (SBS). Reports differ on the label: Yonhap called it credential stuffing (replaying stolen logins), and Dong-A Ilbo described enumeration (cycling through identifiers).
- Look for buyers. The operator asked an AI assistant where threat actors sell Korean breach data and how to find Korean Telegram data-sales groups (CrowdStrike).
Both flaw types are old, and no CVE has been named. What changed is the tempo. “They keep breaching and pushing through until they find a way,” Dongguk University professor Hwang Seok-jin told SBS.
Why can’t annual pentests keep up with AI attackers?
A pentest report is a snapshot. The attacker’s agent is a live feed. “AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span,” CrowdStrike wrote.
The tooling is a commodity. “There are a great many open-source AI tools like ARTEX,” a Financial Security Institute official told American Banker.
| Who is testing | How often | What it covers | A flaw shipped today can be found |
|---|---|---|---|
| AI-driven attacker | Nonstop; one run lasted 40+ hours | Anything reachable from the internet | Whenever the agent reaches it, if it is exposed |
| Annual or quarterly pentest | 1 to 4 windows a year | The scope in the contract | At the next window, if it is in scope. That can be a year away |
| Continuous agentic pentest | Weekly, monthly, or on every release | Every app and portal you put in scope | At the next scheduled run, if it is in scope |
Detection did not close the gap. Shinhan took 15 hours 26 minutes to detect its intrusion, Hana 41 hours 44 minutes, and KB Kookmin 67 hours 41 minutes (Korea JoongAng Daily). The flaw has to be found and fixed before an attacker’s agent reaches it.
What did Korean regulators order?
Korea’s Financial Services Commission (FSC) told banks and card companies to inspect every externally exposed IT system and close any path to internal data that skips authentication. The orders came at emergency meetings on Oct 2 and Oct 4, 2026 (SBS, American Banker).
- Inventory. List every IT asset and service reachable from outside, customer-facing or not, and examine its vulnerabilities and access controls.
- Authentication. Find pathways that reach internal information without authentication, and confirm authentication is not skipped or weakly applied.
- Data access. Stop exposing personal credit data to employees, loan recruiters, or contractors who don’t need it. The FSC called this exposure the cause of the intrusions (American Banker).
- Threat sharing. Regulators sent five attack IPs to about 500 financial firms on Oct 1 and had counted 33 attack IPs by Oct 6 (The Asia Business Daily).
- Deadlines. Banks and card companies had until Oct 6 to finish emergency checks; other financial firms had until Oct 8.
Outside Korea, the rules set annual testing as the floor:
| Framework | Testing rule |
|---|---|
| PCI DSS 4.0.1, Req. 11.4.3 | External penetration testing at least once every 12 months and after any significant upgrade or change |
| DORA, Art. 24(6) | Tests at least yearly on all ICT systems and applications supporting critical or important functions |
Compliance sets the floor at once a year. The attacker sets the pace. Testing on every release means a significant change never waits a year for its first test.
How should banks defend against AI pentesting agents?
Run the attacker’s playbook on your own perimeter before someone else does.
- Inventory every internet-facing system. Include broker and partner portals, employee mobile back ends, sales tools, and staging sites. The Korean breaches came through these; the banks say internet and mobile banking were not breached (The Korea Times).
- Test authentication and sessions. Check whether any request reaches data without a valid session, whether verification steps can be skipped, and whether every page validates the session.
- Test authorization. Log in as one user and request another user’s record by changing an ID or customer number. If it loads, you have the flaw class reported at Shinhan.
- Limit what partners can see. Remove personal credit data that loan recruiters, contractors, and staff don’t need to view.
- Rate-limit logins and lookups. Lock out repeated failures and alert on bulk record access from one session or IP.
- Take internal tools off the open internet. Put employee and partner tools behind VPN or zero-trust access where you can.
- Block and hunt the published indicators. CrowdStrike’s advisory lists the campaign’s proxy IPs and attacker server.
- Retest on every release. A portal that passed last quarter can fail after one deploy.
Where Reflectiz fits
How does Reflectiz Offensive Hub test for these flaws?
The attacker’s agent and a defender’s agent do the same work. The difference is who reads the findings.
Same flaw, two outcomes
If the attacker’s agent gets there first
If your agent gets there first
Reflectiz Offensive Hub is a continuous agentic pentesting platform for web applications. It tests for the flaw classes reported in the Korean breaches:
- Authentication and authorization. Tests authentication bypass, MFA bypass, IDOR, and horizontal and vertical privilege escalation.
- Real login flows. Drives a real browser through logins, one-time passcodes, and two-factor prompts, so it reaches the portals behind the login page.
- APIs and business logic. Tests API-specific flaws, workflow bypass, and race conditions.
- Your cadence. Runs on demand, weekly, monthly, or continuously, with off-peak windows.
- Proof, not noise. A separate validator agent reproduces each finding with the same payload before it reaches your report.
- Safe to run. Needs a URL. If the app has a login, it uses dedicated test accounts. No agent to deploy, no code changes, and no real user PII or company data required.
- Faster fixes. Atlas, the AI remediation assistant, explains each finding in plain language and guides the fix.
A manual pentest is a time-boxed engagement against an agreed scope. Offensive Hub runs on your cadence and validates each finding with a separate agent.
An honest scope note. Agentic pentesting does not replace MFA, rate limiting, bot defense, or a SOC, and Offensive Hub does not block a live intrusion. Within the apps and roles you put in scope, it can find the open doors before someone else walks through them.
See it in action in the Offensive Hub product walkthrough, or read the CISO guide to agentic pentesting.
Sources
- CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (Oct 7, 2026)
- Reuters: Suspect behind South Korea bank hacks may be 26-year-old in China, cybersecurity firm says (Oct 8, 2026)
- American Banker: AI-linked hacks hit Korean banks through loan-agent sites
- Korea JoongAng Daily: From banks to lenders, suspected AI hacks expose cracks in Korea’s financial defenses
- The Korea Times: Shinhan, KB Kookmin data breaches raise concerns over AI-powered cyberattacks
- SBS: Shinhan Bank suffers customer information leak via loan broker page
- SBS: Authorities order banks and credit card companies to conduct self-security checks
- SBS: Spreading hacking damage in banking sector
- The Asia Business Daily: FSS says 33 IP addresses identified in hacking attempts
- BleepingComputer: ARTEX AI, Claude agents used in cyberattacks on South Korean banks
- Forkast: South Korean banks hit by an autonomous AI pentesting agent
- PCI DSS Requirement 11 (Microsoft Learn)
- DORA Article 24 (Advisera)
FAQs
Which South Korean banks were hacked in 2026?
Seven Korean banks and lenders reported data leaks between late September and early October 2026: Yegaram Savings Bank (about 40,000 customers), Shinhan Bank (about 25,700), Welcome Savings Bank, Hyundai Capital, KB Kookmin Bank, Hana Bank, and BNK Busan Bank, according to Korea JoongAng Daily. Reports link AI tools to some of the attacks, but not to every firm. Woori Bank and NH NongHyup Bank also reported attacks, but no information was exposed, according to The Korea Times.
How did the attackers get into the banks?
Reports say the attackers got in through internet-facing internal tools with weak authentication: Shinhan Bank’s lookup service for loan brokers, KB Kookmin Bank’s employee mobile work-support system, and Hana Bank’s sales-support system. BNK Busan Bank cited insufficient session validation. Entry points were not disclosed for every firm, and no CVE or zero-day has been named. The banks say their internet and mobile banking platforms were not breached.
What is ARTEX?
ARTEX is an open-source agentic penetration testing tool developed in China. CrowdStrike linked it to attacks on two unnamed Korean banks after finding the operator’s session logs and ARTEX configuration files in open directories on attacker servers. CrowdStrike names no banks and says the number of affected organizations is unconfirmed. Its developer closed the source on October 8, 2026, but derivatives remain in circulation.
Was customer money stolen in the Korean bank hacks?
No customer financial losses have been confirmed, and the attackers did not obtain passwords or one-time codes, according to American Banker. Korean regulators warned that the stolen income and loan data could be used for fake loan offers.
What is agentic pentesting?
Agentic pentesting, also called agentic penetration testing, uses AI agents that plan and run testing steps on their own, such as probing logins and trying requests, while a human sets the target and scope and reviews the results. Defenders can run it on a schedule to look for flaws such as authentication bypass and broken authorization in the apps and roles they include in scope.
How often should banks pentest their web applications?
PCI DSS 4.0.1 requires external penetration testing at least every 12 months and after significant changes, and DORA requires yearly tests of systems that support critical functions. AI-driven attackers test continuously, so test every internet-facing app on a schedule and after every release.
Could agentic pentesting have prevented the South Korean bank breaches?
Agentic pentesting could help identify authentication and authorization weaknesses in exposed portals, provided those systems and relevant user roles are included in testing. Public reporting does not establish that a specific defensive tool would have prevented these incidents. Prevention also depends on remediation, access controls, and monitoring.
Subscribe to our newsletter
Stay updated with the latest news, articles, and insights from Reflectiz.
Related Articles
AI Has Changed The Web.
Are You Ready for What’s Next?
Third-party code shifts by the hour. Supply-chain compromises strike without warning. AI-driven web attacks now evolve faster than traditional security can ever keep up.
Reflectiz delivers the continuous, real-time visibility needed to expose the risks traditional tools miss entirely.
Zero code changes. Zero access to your data. Ultimate peace of mind.
