Hacker Left Their CV in Exposed AI Logs While Attacking Korean Banks
Someone attacking South Korean financial institutions forgot a basic rule of cybercrime: don't ask the AI to polish your resume mid-operation.
CrowdStrike researchers looking into breaches at multiple South Korean lenders stumbled across exposed AI session logs on an attacker-controlled server. Buried in those logs was a resume-writing request naming someone called "YY," listing a Chinese university, a Guangdong location, and an age that didn't quite add up. The prompt claimed the person was 26, but the birth date given put them at 17. Someone was fudging the numbers somewhere.
Analyst Ashley Campion published the findings on Wednesday. CrowdStrike stops short of definitively identifying the attacker, but considers the personal details likely to be genuine rather than planted noise.
The targets were serious institutions. The Korea Times reported at least five banks were hit: Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank, and BNK Busan Bank. Shinhan alone said around 25,000 customers were affected. KB Kookmin and Hana reported 119 and 89 affected customers respectively. The attackers allegedly wormed their way into a loan progress inquiry service in one case, and a mobile work-support system in another.
The technical setup is what makes this case genuinely interesting rather than just embarrassing. The attackers used ARTEX, a recently released open source penetration-testing tool built in China, alongside Anthropic's Claude Code. CrowdStrike found the YY references scattered across AI sessions tied to ARTEX activity, suggesting the AI tooling wasn't just incidental, it was baked into the workflow.
A Chinese-language instruction file on one exposed server pointed researchers toward a second server in Hong Kong, where they found session histories, configuration files, and AI memory files detailing the targeting operation. The Telegram username from the resume prompt also appeared in activity aimed at what looks like a Chinese payment platform, and in Claude Code sessions hunting for vulnerabilities in a Telegram-based NFT marketplace. The attacker appears to have been running several operations in parallel.
CrowdStrike's assessment is blunt: agentic AI tools are letting financially motivated attackers hit more targets faster. The old constraint of needing time and expertise to manually probe systems one at a time is eroding. That's not a surprise to anyone paying attention, but seeing it documented in actual attack telemetry is a different thing from reading about it in a threat forecast.
South Korean lawmakers have approved plans to haul the heads of five major commercial banks before a parliamentary audit on October 19 to explain how their cybersecurity failed. Whether this was one person with a poorly proofread birth date or an organised group remains under police investigation.