Korean financial sector hacker, estimated to be 26 years old from Guangdong Province, China... Identifying Clues

CrowdStrike, check Claude usage records for clues such as residence and age

Circumstances of personal information being exposed while writing a security researcher resume... Identity has not yet been confirmed

(Seoul = Yonhap News) Reporter Kwon Ha-young = Clues regarding the identity of the person believed to be behind the recent hacking attack targeting the Korean financial sector have been discovered for the first time.

Global cybersecurity company CrowdStrike stated in an analysis report released on the 7th (local time) that the attacker was likely a 26-year-old person living in Guangdong Province, China.

However, this is an estimate based on the circumstances and is not a definitive identification of the identity.

According to CrowdStrike, this clue was exposed when the attacker used the generative artificial intelligence (AI) coding tool 'Cload Code'.

The attacker asked Claude to write a resume as a security researcher containing his penetration testing achievements, and during this process, personal information such as name initials, Telegram account, education level, and place of residence were entered.

The report said that the Telegram account was also found in other cyberattacks.

It was discovered that the same account name was used in a session investigating vulnerabilities in the Telegram-based non-fungible token (NFT) futures marketplace and in an attack targeting a payment platform in China.

CrowdStrike suggested the possibility that they were the same person based on these cross-cutting circumstances, but added that the identity could not be determined solely based on the information secured to date.

Previously, CrowdStrike analyzed that an attack targeting Korean financial institutions was carried out between the end of last month and the beginning of this month, and that the attacker used 'ARTEX', an open source agentic penetration testing tool developed in China, and the Large-Scale Language Model (LLM).

The possibility that this attacker, believed to be a Chinese speaker, was motivated by financial incentives was assessed as a medium level of confidence.