The Wave Spreading Across Asia

South Korea's financial industry is enduring its third week of consecutive cyberattacks, with fresh breaches confirmed Wednesday affecting three major institutions: brokerage Daishin Securities, cryptocurrency exchange Bithumb, and asset manager Mirae Asset Global Investments. The publicly identified number of affected firms and institutions has reached 20, spanning traditional banks, savings banks, crypto platforms, and insurers — nearly every segment of the sector except credit card companies.

Daishin Securities reported the most direct impact: personal and financial information belonging to 38,490 customers was compromised after hackers accessed a server linked to its online account-opening service for discretionary investment services. The breach exposed names, email addresses, residential addresses, login IDs, bank names, deposit and withdrawal account numbers, Daishin account numbers, and mobile phone numbers — though account numbers and phone numbers are encrypted. The brokerage first detected suspicious access on October 17 and subsequently analyzed more than 60,000 requests that masqueraded as legitimate service traffic over a ten-day period.

Bithumb reported unauthorized access to its internal mobile groupware system operated by third-party platform Daou Office. The exchange stated that customer assets were unaffected because the compromised system is physically separated from its trading network. Mirae Asset Global Investments confirmed unauthorized access to some web systems but said no unique identification data, sensitive information, or personal credit information was compromised.

But what's notable isn't just the numbers — it's the method. The second wave, spreading from banks and savings banks to brokerages, exchanges, and insurers, presents a distinct pattern. The first wave (September) was linked by CrowdStrike to a suspected Chinese operator using ARTEX, an open-source agentic penetration testing tool developed in China. The new wave remains under investigation.

The ARTEX Trail

CrowdStrike's analysis of the first wave — which affected banks including Shinhan, KB Kookmin, BNK Busan, and Hana — revealed striking details. The attack exploited a loan progress inquiry service used by brokers and compromised an employee mobile work-support system.

What CrowdStrike found on attacker-controlled servers was an arsenal of generative AI tools: Claude Code session histories, ARTEX configuration files, and Claude memory files. The prompt found was a Chinese-language document specifying how the LLM should conduct penetration testing activities — literal instructions for an AI model to act as a human penetration tester.

The attack used multiple proxy IP addresses and an instance hosted at 38.244.50[.]120, containing the .claude/CLAUDE.md document with Chinese instructions for conducting pentest activities. The infrastructure also included a Hong Kong IP with open directories containing complete pentest sessions.

According to CrowdStrike, the actor is likely a Chinese speaker and financially motivated. The firm classified the activity under MITRE ATT&CK as T1588.007 — Obtain Capabilities: Artificial Intelligence.

"This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span," the CrowdStrike report states. "We assess that adversaries will continue to experiment with implementing AI tooling in their operations to enhance operational tempo and capabilities."

4.4 Million Scanning Attempts

A striking data point: on October 21, regulators detected 4.4 million scanning attempts originating from IP addresses classified as North Korean, starting at 3 a.m. Scanning — the search for open ports and vulnerabilities on target servers — lasted approximately one full day before ceasing.

However, financial authorities warn against the simplistic reading that North Korea is behind the attacks. According to analysis of actual network packets, the packets from North Korean IPs contained only the "response to the request" — the second stage — and not the initial connection request. This suggests a third party spoofed financial companies' IP addresses as the source to request connection to North Korea, causing North Korea's response to be routed back to the financial institutions.

"IP addresses alone cannot establish an attacker's nationality or affiliation, because address information can be manipulated and traffic routed through other locations," said an official at the Financial Security Institute (FSI).

This sophisticated spoofing pattern is consistent with an experienced attacker using evasion techniques to complicate attribution, not a North Korean state actor operating directly.

The Other Side of the Coin

KB Kookmin Bank illustrates the systemic failure well: the attack began at 11:19 p.m. on September 27, but was classified as "routine abnormal traffic." The response was simply to block the IP address. The bank faced further attacks, and the number of compromised records jumped from 119 to 2,210 — 18.6 times more.

Shinhan Bank took 15 hours and 26 minutes to detect an attack that began at 6:04 p.m. on September 28. The result: 25,727 records containing personal information leaked.

"We classified attack activity as routine abnormal traffic and responded only by blocking the IP" — this may be the most alarming sentence about cybersecurity that one can read in 2026.

What This Means

The South Korea financial wave exists in isolation only in name. In Japan, GMO Internet reported a security incident involving stolen customer data. In Europe, 123 Reg reported the same modus operandi: the same group suspected of the South Korea attack may also be behind the European breach.

What we're witnessing is the democratization of high-complexity cybercrime. Penetration testing tools that were once the exclusive domain of professional security teams — or state-sponsored adversaries — are now available in open source, with Chinese-language prompts that turn LLMs like Claude into autonomous attack agents.

The question isn't "who is behind this" — because IP spoofing shows that even that may be a distraction — but rather: how many other financial industries in other emerging markets have already been attacked without investigators recognizing the AI signature?

More importantly: if an attacker needs only a Chinese-language prompt and access to Claude Code to compromise 20 financial institutions in weeks, what's the barrier for the next operator to do the same on another continent?

AI didn't create cybercrime. But it ended the scarcity of expertise that was previously the biggest obstacle to sophisticated hacking operations. ARTEX isn't the weapon — it's the catalyst that transforms any financially motivated actor into a threat capable of operating at global scale.

Everything changes. It's no longer about having the best defense; it's about surviving the first wave before the second arrives.

It's no longer about prevention — it's about detecting faster.

And when AI can conduct more intrusions in weeks than a hacker group would in years, the question isn't "who is behind this" — but rather: who will detect the next attack before the data leaks?

Because the next one won't be in Seoul. It'll be anywhere. And who knows, who knows, it may already be underway.

The scarcity of expertise in offensive cybersecurity is over. What remains is the scarcity of real-time detection. And that is a difference that changes everything.

Sources: TechCrunch, The Korea Herald, CrowdStrike, The Register

✓ Independent sources cross-checked and verified before publishing