DeepSeek Exploited by Hackers, Multiple Korean Financial Institutions Suffer Data Breaches

Overview

Recently, multiple financial institutions in South Korea have been targeted by cyberattacks, resulting in the leakage of sensitive information belonging to numerous clients and employees. According to the latest report released by cybersecurity giant CrowdStrike, attackers leveraged the open-source penetration framework ARTEX in combination with various large language models between late September and early October to automatically scan and exploit security vulnerabilities in these banks.

This attack does not constitute traditional brute-force methods but rather represents “smart hacking” behavior powered by artificial intelligence. The attackers deployed models such as DeepSeek V4.1 Flash, GLM-5.3, and Grok 4.6, running them within a Claude Code environment to achieve automated vulnerability discovery and exploitation. This new attack pattern marks a shift in cyber threats from manual operations to automated AI-driven processes.

Attack Details and Technical Analysis

Investigations indicate that the attackers primarily utilized the Chinese open-source penetration framework ARTEX as their backend tool. This framework allows for flexible switching between multiple large language models, forming a collaborative attack chain. Specifically, DeepSeek V4.1 Flash served as the main backend engine, responsible for core logical analysis and vulnerability probing, while GLM-5.3 and Grok 4.6 acted as auxiliary models, providing additional context understanding and code generation capabilities.

“One person combined with switchable AI large models scanned multiple Korean banks in a week.” This description accurately summarizes the efficiency and stealth of this attack.

The attackers integrated the aforementioned models onto Claude Code, constructing an automated penetration testing environment. This system could autonomously analyze target system API interfaces, authentication mechanisms, and data transmission processes, automatically identifying and exploiting security configuration errors. Compared to traditional attacks, this approach significantly reduces dependence on human expertise, enabling attackers without technical backgrounds to carry out sophisticated network intrusions.

Scope of Victims and Information Leakage

This attack impacted multiple major financial institutions in South Korea, causing severe consequences. It was disclosed that approximately 25,000 customers of Shinhan Bank had their personal information leaked, including sensitive data such as loan inquiry records. Kookmin Bank and Hana Bank were also not spared, with information leakage affecting approximately 119 and 89 individuals, respectively.

The leaked data extended beyond personal identity information to include mobile office system accounts for employees and partial business data. By stealing this information, the attackers may further commit secondary crimes such as telecom fraud, identity theft, or the sale of internal information. Since the breach involved loans and office systems, the scope of impact exceeds mere privacy leakage and may have long-term effects on the victims’ financial status and occupational security.

Source Tracing and Motive Speculation

Currently, security agencies are at the stage of making moderately confident inferences regarding the attackers’ identities. Based on the usage patterns of the attack tool (ARTEX), Chinese language characteristics found in the prompts, and the attackers’ inquiries about prices in the Korean data black market during sessions, analysts lean toward the belief that the attackers may have a Chinese background and are primarily motivated by financial gain.

Infrastructure tracing reveals that the command-and-control server was located in Hong Kong, hiding its true traces behind multiple proxy IPs. Despite the use of complex proxy chains, no evidence directly linking the attack to any known hacker groups (such as APT29 or the Lazarus Group) was found. This suggests that the attack is more likely a commercialized cybercrime initiated by an individual or a small gang for profit, rather than a state-sponsored cyberspace warfare operation.

Security Implications

This incident once again highlights the “double-edged sword” effect of artificial intelligence technology in the field of network security. On one hand, AI significantly enhances the efficiency of penetration testing and vulnerability discovery; on the other hand, attackers can also utilize the same tools to execute automated attacks, thereby lowering the threshold for crime.

Financial institutions urgently need to strengthen real-time monitoring of API interfaces, third-party integrated tools, and large model access points. Meanwhile, security teams should pay attention to new attack vectors based on LLMs and update defense strategies to cope with increasingly intelligent cyber threats. For the public, regularly checking account activity and being vigilant about abnormal login alerts are also important means of preventing such risks.