How AI Helped Hack Korean Banks—and Why Poor Security Opened the Door

AI Did the Heavy Lifting—All of It

CrowdStrike’s counter adversary operations team traced the attacks and recovered AI session records showing exactly how the intrusions unfolded. The attacker used ARTEX, a Chinese-developed AI penetration-testing tool, alongside large language models to do things that previously required real expertise.

Finding vulnerabilities. Crafting SQL injection attacks. Navigating target systems. Adam Meyers, CrowdStrike’s SVP of counter adversary operations, was asked what the AI specifically enabled the attacker to accomplish. His answer: “All of it.”

That’s not hyperbole—it’s a structural shift. The skill floor for executing a serious cyberattack just dropped significantly.

The Door Was Already Open

Here’s the part that stings: AI didn’t break into these banks. Weak fundamentals let it walk in.

Several institutions were breached not through core banking platforms but through peripheral systems—employee tools, loan broker portals, API layers. These supporting systems apparently weren’t getting the same security scrutiny as the main infrastructure.

Meyers put it plainly: if you only test the central banking system and ignore the employee or API systems, you’ve left those systems exposed. One savings bank was running database software with an unresolved vulnerability that was over a decade old.

Meanwhile, Woori Bank—targeted but not breached—pointed to additional employee authentication measures as a likely reason it avoided damage. The contrast is hard to ignore.

“You Need to Test Before the Bad Guys Test”

South Korea’s financial regulators confirmed breaches at 16 financial companies, with personal data from roughly 100,000 people exposed. At a parliamentary hearing, bank executives pledged more investment in AI-powered cybersecurity.

Meyers’ response to that: good, but not sufficient on its own.

“They need to do both.”

AI defenses matter. So do the basics—vulnerability assessments, patch management, staff training, and monitoring systems that can catch suspicious activity across the entire network, not just the crown jewels.

The growing availability of AI security testing tools means organizations can now run continuous, automated checks rather than relying on periodic audits. That’s the shift Meyers is pushing for.

What This Actually Means for Security Decisions

A few things worth taking away from this:

• AI lowers the attacker skill floor. You can no longer assume that unsophisticated actors won’t find sophisticated vulnerabilities.
• Perimeter thinking is a liability. If your security testing stops at the core system, your peripheral systems are an open invitation.
• Authentication is still underrated. Woori Bank’s additional employee auth may have been the single most important factor in avoiding a breach.
• Continuous testing beats periodic audits. The threat cadence has changed. Security hygiene needs to match it.

The banks that get breached next won’t necessarily face more advanced attackers. They’ll face the same AI tools, pointed at the same old gaps. The question is whether they find those gaps first.