Claude Code History Exposed After AI-Assisted Attacks on Nine South Korean Financial Firms; CrowdStrike Finds Identity Clues

CrowdStrike has published a technical investigation into AI-assisted attacks on South Korean financial institutions. Claude Code session histories were left in a public directory on an attacker-controlled server, revealing the AI models used and clues to the attacker's identity.

Key points

• What happened: CrowdStrike retrieved the attacker's Claude Code history and ARTEX configuration from a public directory, identifying a two-server infrastructure and the use of DeepSeek, GLM-5.3, and Grok 4.6.
• Why it matters: Attacks on nine South Korean firms affected data relating to more than 65,000 people, and South Korea's Financial Security Institute independently confirmed ARTEX use. A resume contained personal details suggesting a 26-year-old in Guangdong province, but CrowdStrike cautioned that a definitive link could not be established.
• The author's perspective: AI accelerated the attacks but did not improve the attacker's ability to erase traces. The exposed operation logs provided investigators with a breakthrough, highlighting both the threat of AI-assisted attacks and the attacker's poor operational security.

Operation logs left in a public directory

On October 7 local time, CrowdStrike published an analysis of infrastructure linked to a campaign targeting South Korean financial institutions. The IP address 38.244.50[.]120 hosted an instance of ARTEX (an autonomous AI penetration-testing framework) alongside a publicly accessible directory. That directory exposed a Claude Code Markdown document containing a penetration-testing prompt written in Chinese and another IP address in Hong Kong.

Following the Hong Kong address revealed more Claude Code session histories, ARTEX configuration files, and Claude memory files. Joho no Todai found that CrowdStrike's report details the procedures, infrastructure, and AI models identified from those files.

Two servers and three AI models

The Claude Code session histories revealed a two-server infrastructure. The Hong Kong IP address served as the attacker's main control server, while 38.244.50[.]120 hosted the ARTEX instance that carried out attacks on South Korean financial institutions.

ARTEX used DeepSeek v4.1-flash as its main LLM backend, while additional Claude Code sessions used GLM-5.3 from Zhipu AI and Grok 4.6. Access to DeepSeek may have been routed through the LLM API proxy reseller xcai[.]pro.

The attacker also operated through nine proxy IP addresses, which CrowdStrike published as indicators of compromise (IOCs).

ARTEX is an open-source tool released on GitHub on July 26. Combining LLMs with a multi-agent architecture, it automates reconnaissance, vulnerability discovery, attack-path planning, execution, and verification. Although primarily aimed at Chinese-speaking users, anyone can download it.

Clues about a 26-year-old in a resume

The Claude Code logs also contained traces unrelated to the technical attacks.

In one session, the attacker asked Claude Code to write a resume for a security researcher, explicitly instructing it to include the results of the attacks as achievements. The prompt contained personal details: Telegram account @YY520CN, age 26, graduation from South China University of Technology, and residence in Maoming, Guangdong province.

@YY520CN had also been used in vulnerability research against a Telegram-based NFT marketplace and attacks on a Chinese payment platform.

Another session contained a question about finding Telegram groups where the leaked South Korean data could be sold.

CrowdStrike considered it likely that the personal details belonged to someone involved in the ARTEX-related attacks, but explicitly stated that it "cannot definitively attribute" them at this point. Its assessment that the attacker was Chinese-speaking and financially motivated carried only "moderate confidence," and it did not link the activity to the Chinese government.

Impact across nine companies

A total of nine South Korean financial institutions were targeted. Data leaks were confirmed at seven (in Japanese): Shinhan Bank (around 25,000 people), KB Kookmin Bank (119), Hana Bank (89), BNK Busan Bank (11 contractor staff), Yegaram Savings Bank (around 40,000), Welcome Savings Bank, and Hyundai Capital. Woori Bank and NH NongHyup Bank were also attacked but suffered no damage because the targeted vulnerabilities were not present.

Figure omitted — see the original article

The targets were not the online banking systems customers use directly, but business support systems used by bank employees and loan brokers. Services for checking loan application status and mobile tools for sales representatives—externally accessible business systems generally less protected than core transaction platforms—provided entry points.

South Korea's Financial Security Institute confirmed ARTEX use from Shinhan Bank's attacking IP addresses and server logs. The attacks used IP addresses in eight countries, including South Korea, the United States, Japan, and Hong Kong, making attribution based on IP addresses alone difficult.

On October 6, South Korean President Lee Jae-myung (in Japanese) told a cabinet meeting that some hacking incidents showed signs of AI use and ordered a comprehensive overhaul of cyber defenses for the AI era.

The attacker was human; AI was the tool

Summarizing this case as "AI attacked banks" would be inaccurate. South Korea's Financial Security Institute said clearly that AI was used in the attacks but did not act independently without human involvement.

The attacker used Claude Code to organize the operation, connected DeepSeek, GLM, and Grok to ARTEX to automate the intrusions, and appeared to seek buyers for the stolen data on Telegram. AI sped up reconnaissance and intrusion, enabling attacks against multiple financial institutions in a short period.

Yet the person wielding that AI left operation logs in a public directory, included attack results on a resume, and asked AI where to sell the data. CrowdStrike obtained so much information because of the attacker's carelessness. AI made the attacks faster, but the attacker's ability to cover tracks remained unchanged.

Originally published in Japanese on Joho no Todai.