Person in Their 20s in China's Guangdong Suspected Behind Financial Sector Hacks; Used DeepSeek and Other AI Models

CrowdStrike Releases Report
Residence, Age, and Other Clues Found in Claude Usage Records

A hacking attack targeting South Korea's financial sector may have been carried out by a person in their 20s living in Guangdong Province, China.

Yonhap News

Global cybersecurity firm CrowdStrike released an analysis report on October 7 local time, saying the attacker may be a 26-year-old living in Guangdong Province, China. However, it said this was an inference based on circumstantial evidence and did not constitute a definitive identification.

The clue emerged during the attacker's use of Claude Code, a generative AI coding tool. The attacker asked Claude to write a resume for a security researcher highlighting their penetration-testing achievements, and provided personal information including their initials, Telegram account, educational background, and place of residence.

During this process, the attacker also asked Claude where stolen South Korean financial data was being sold and how to find Telegram groups selling data in Korean.

The same Telegram account was also found in evidence related to other cyberattacks. The account name was used in a session investigating vulnerabilities in a Telegram-based non-fungible token (NFT) gift marketplace, as well as in an attack targeting a Chinese payment platform.

CrowdStrike cited several circumstantial clues suggesting the incidents may have involved the same person, while stressing that the individual's identity could not yet be confirmed.

Meanwhile, according to CrowdStrike's analysis, the attacker used a two-tier structure: a Hong Kong-based IP address served as the main control infrastructure for directing the attacks, while the Artex server used in the attacks on South Korea was operated from a separate IP address. The key AI model used to run Artex was DeepSeek's lightweight model, "v4.1-Flash," and the attacker accessed it indirectly through a third-party reseller rather than through an official channel.

The attacker also used other LLMs as supplementary tools, including GLM-5.3 from China's Zhipu AI and Grok 4.6.

The hacking incidents came to light after breaches occurred at seven financial institutions from late September through early October: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. Although the IP addresses used to attack the commercial banks, savings banks, and capital finance company differed, evidence indicated that the same attacker had targeted multiple financial institutions using similar methods while changing IP addresses.

This content was produced with the assistance of AI translation services.