AI-Assisted Cyberattacks Expose Basic Security Gaps in Korean Finance

Artificial intelligence gave a relatively inexperienced attacker the ability to breach systems linked to South Korean financial institutions, but basic security weaknesses ultimately made the intrusions possible, according to a senior CrowdStrike executive.

Adam Meyers, the US cybersecurity company’s senior vice president of counter adversary operations, said AI tools allowed the attacker to perform work that previously required specialist knowledge. Those tasks included identifying website vulnerabilities and executing SQL injection attacks, which exploit weaknesses in the way websites communicate with databases.

CrowdStrike’s investigation found that the attacker used ARTEX, a Chinese-developed AI penetration-testing tool, together with large language models. The company traced servers used by the attacker and recovered AI session records that helped reconstruct how the campaign was conducted. Meyers said the AI supplied capabilities across the attack process, while poor security practices on exposed systems enabled the breaches to succeed.

The findings sharpen concerns about the expanding cyber risks facing Korea’s financial sector. Korean financial regulators have confirmed hacking incidents at 16 financial companies, with personal information belonging to roughly 100,000 people exposed. Not all of those incidents have been attributed to the same AI-assisted campaign.

Several compromised targets were support systems used by employees or loan brokers rather than core banking platforms. That distinction limits what can be inferred about the security of central banking systems, but it also highlights a broader weakness: organizations may devote substantial resources to protecting their most critical infrastructure while leaving connected services, application programming interfaces and staff-facing tools less thoroughly tested.

Meyers warned that vulnerability assessments must cover every internet-facing asset, not only core platforms. If banks test central systems but neglect employee services or APIs, attackers can exploit those peripheral routes as entry points. He said financial institutions need both stronger AI-supported defenses and better execution of established security practices.

The immediate priority, he said, is to identify vulnerabilities quickly, patch weaknesses and train personnel. Whether that work is performed by human specialists or assisted by AI is less important than maintaining mature processes across the entire technology environment.

The campaign illustrates how AI can compress the skills and time required to launch sophisticated attacks. It also shows that advanced defensive tools alone cannot compensate for neglected systems. For Korean banks and other financial companies, the response will require investment in new technology alongside systematic attention to access controls, software maintenance and the full range of connected services.