Hackers Use Claude, DeepSeek and Grok in AI-Assisted Attacks on South Korean Banks

What happened

Researchers from Recorded Future’s Insikt Group identified tools for stealing cryptocurrency wallet files, expanding access to Linux systems, and testing mobile devices. In its October 16 report, the team tracked the actor as TAG-217 and showed that preparations began in August, weeks before the banking attacks became public.

Industry sources linked it to the banking attacks, while public analysis on October 7 identified the operator’s use of several AI tools. Hackers linked to attacks on South Korean banks used Claude Code, DeepSeek, Grok, and Zhipu AI alongside ARTEX, an open-source AI penetration testing framework.

The campaign shows how attackers can combine AI services with familiar hacking tools to search for weaknesses across different systems, while leaving evidence that helps investigators trace their work.

Cyber Attack Cyber Security News 4 min.

Public reporting cited in the investigation said the breaches exposed personal information belonging to at least 68,000 people across at least seven financial institutions. The wider South Korean banking investigation followed disclosures involving different services and types of data, rather than one shared weakness affecting every bank.

The report does not identify a single named malware (software written to damage a system or steal from it) family behind every intrusion.