CrowdStrike researchers investigating cyberattacks on at least five South Korean banks discovered exposed AI session logs that may reveal the attacker's identity, including a resume-writing request naming "YY," linked to a Chinese university and a location in Guangdong. The attacker used a combination of AI tools, including Claude Code and the open-source penetration-testing tool ARTEX, to breach systems across multiple financial institutions in a short timeframe. South Korean police are investigating whether an individual or organised group was responsible, with parliamentary scrutiny of the affected banks planned for October 19.
