- A threat actor, aided by artificial intelligence, inadvertently disclosed his identity plus other details in a query directed to Claude about composing a personal resume on the open server.
- The attacker utilized automated tools and generative AI models in compromising internal business systems of Shinhan Bank, KB Kookmin Bank, and Hana Bank.
- Exposed terminal logs revealed the identity of the hacker as ‘YY’ from Maoming, China, while confirming that financial gain motivated the multi-bank cyber campaign.
A lone threat actor operating with artificial intelligence agent software accidentally revealed his personal identity online. The cybercriminal exposed his active coding terminal sessions after leaving an unauthenticated directory open on a public server.
Investigators discovered that he instructed the Claude Code platform to generate a professional resume. The generated draft listed his alias as ‘YY’, identified him as a 26-year-old resident of Maoming, China, and included his personal Telegram handle.
The operational lapse ties the person to prominent cyberattacks on major South Korean banks. Shinhan Bank, KB Kookmin Bank, and Hana Bank are among some of the affected institutions. Cybersecurity experts have verified the claim that this person used automated AI agents to circumvent security measures and steal banking data.
Accidental Exposure of Hacking Infrastructure
The operational blunder transpired when the cybersecurity experts checked out a command-and-control server, which had an unsecured web directory. This web directory contained raw execution logs of the automated AI session logs.
While deploying autonomous tools to execute system exploits, the threat actor simultaneously used the terminal interface for personal administrative tasks. The terminal logs captured raw command prompts, code scripts, and output files directly in public directories.
However, the recorded logs revealed much more than simple code executions. In addition to providing instructions for writing resumes, the terminal logs had information about the online platforms where the stolen financial records are sold. The information provided in these logs indicated that the hacker was motivated by financial gain, rather than by interests in state intelligence.
Besides, the analysts managed to acquire the communication handles of the person, routes of IP traffic, and regional configurations from unencrypted terminal logs. These logs provided law enforcement officers with sufficient material evidence to link the attack with a physical operation in China.
Security teams tracked the server configuration settings to local networks in Guangdong province. Moreover, forensic teams evaluated the end-point processes to rebuild the exact timeline of the intrusion campaign. The accidental exposure destroyed the operational anonymity of the attacker across global forums.
Exploitation of South Korean Banking Systems
The underlying cyber campaign targeted public-facing web portals and third-party loan processing frameworks managed by leading commercial banks. Official threat reports from CrowdStrike indicate that the hacker deployed automated penetration testing scripts alongside generative AI tools. In addition, he integrated the open-source ARTEX framework with large language models to identify application programming interface vulnerabilities automatically.
The automated scripts executed rapid vulnerability scans across target web servers. Once the scripts identified weak access points, the AI agent executed automated payload injections to siphon stored customer records.
As a result, Shinhan Bank reported compromised personal details belonging to thousands of customers. The wider impact of South Korea’s banking data exposure has also drawn attention to dark web activity, as reported in South Korea’s Coupang data leak triggers surge in dark web activity.
Consequently, Hana Bank and KB Kookmin Bank detected similar unauthorized system accesses on external employee platforms.
The compromised files contained details such as customer names, phone numbers, annual income records, and credit card information. Regulatory authorities have acted quickly and sent their investigation teams to investigate related web servers and isolate vulnerable systems.
Therefore, the banks updated their authentication protocols to block automated bot traffic across public portals. Indeed, primary banking ledgers and core transaction databases remained isolated from the external breach.
Implications of Automated AI Intrusions
This breach is significant as it shows a change in modern threat approaches. Cybercriminals take advantage of the possibilities offered by modern AI technologies to automate operations that previously required manual controls.
Using autonomous scripts together with commercial LLM instances, single actors can initiate fast and multi-staged attacks against major business targets. However, depending entirely on automated tools without security measures against potential risks makes the actions of threat actors vulnerable to critical operational errors.
Mixing the operational workflows of attacks with personal interactive sessions in shared terminal spaces created acute operational security breaches. The attackers never configured basic access controls on his remote command servers.
Security analysts had immediate visibility into his ongoing operations without triggering alarms. The incident showcases that attackers have the ability to act much quicker with automated scripts compared to human controls. But the processes also unveil new operational weaknesses.
International intelligence agencies are moving ahead with analyzing the leaked telemetry files in a bid to trace secondary cryptocurrency wallets. Analysts seek to identify the proxy networks the attacker used to exploit the multiple banks.
Furthermore, financial institutions around the world are hardening their perimeter defenses against autonomous AI scanning tools. Security researchers expect threat groups to tighten their operational security after this major public exposure. This blunder offers more insight into threat intelligence for the defense of critical banking infrastructure globally.
