Suspect behind South Korea bank hacks may be 26-year-old in China, cybersecurity firm says
CRWD•CrowdStrike said the suspect behind cyberattacks on South Korean financial institutions may be a 26-year-old in Guangdong province, China. The attacks affected multiple institutions, including Shinhan Bank and KB Kookmin Bank.
1. Suspect details
CrowdStrike said it found personal details linked to the suspected attacker while analysing AI coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October. The firm assessed with “moderate confidence” that the actor was a Chinese speaker and likely financially motivated.
2. Investigation continues
CrowdStrike said a Claude Code session included a request to create a security researcher resume describing hacking results, with details including a Telegram account, age, education and a location in Maoming, Guangdong. The firm said the details likely belonged to the actor but could not definitively identify the attacker. South Korean police have launched a probe, and President Lee Jae Myung said signs had emerged that AI was used in some incidents.
