美国网络安全公司CrowdStrike表示，近期针对韩国金融部门的网络攻击嫌疑人可能是一名居住在中国广东省的26岁人士。
The suspect behind recent cyberattacks targeting South Korea’s financial sector may be a 26-year-old based in China’s Guangdong province, U.S. cybersecurity firm CrowdStrike has said.
CrowdStrike周三在其网站上发布的报告称，该公司在分析9月底至10月初针对韩国金融机构的攻击活动相关的AI编码工具会话及基础设施时，发现了与疑似攻击者相关的个人详细信息。
In a report published on its website on Wednesday, CrowdStrike said it uncovered personal details linked to the suspected attacker while analyzing AI coding-tool sessions and infrastructure associated with a campaign targeting South Korean financial institutions from late September to early October.
CrowdStrike指出，攻击者使用了中国开发的开源渗透测试工具ARTEX以及大语言模型，并以“中等置信度”评估该行为人为中文使用者，且可能受经济利益驱动。
CrowdStrike said the attacker used ARTEX, a recently released Chinese-developed open-source penetration testing tool, alongside large language models and assessed with “moderate confidence” that the actor was a Chinese speaker and likely financially motivated.
该公司称，其中一个Claude Code会话包含创建安全研究员简历的请求，以描述黑客活动的成果。
The firm said one Claude Code session contained a request to create a security researcher resume describing results from the hacking activity.
报告称，该提示词中包含了Telegram账户、年龄、教育背景以及位于广东茂名的地点等详细信息。
The prompt included details such as a Telegram account, age, education background and a location in Maoming, Guangdong, the report said.
CrowdStrike表示，相同的Telegram用户名出现在其他网络活动中，包括涉及基于Telegram的非同质化代币（NFT）市场的漏洞研究，以及对一家中国支付平台的疑似攻击。
CrowdStrike said the same Telegram username appeared in other cyber activity, including vulnerability research involving a Telegram-based non-fungible token marketplace and a separate suspected attack on a Chinese payment platform.
该公司称，这些个人详细信息很可能属于负责该活动的行为人，但警告称目前可获得的信息尚无法确定性地识别出攻击者。
The company said the personal details likely belonged to the actor responsible for the activity, but cautioned that currently available information could not definitively identify the attacker.
首尔当局正在调查影响了多家金融机构的网络攻击，此前包括新韩银行和KB国民银行在内的多家银行报告了数据泄露事件。已展开调查的韩国警方未立即回应置评请求。
Authorities in Seoul are investigating cyberattacks that affected multiple financial institutions after banks, including Shinhan Bank and KB Kookmin Bank, reported data breaches. South Korean police, who have launched a probe, did not immediately respond to a request for comment.
韩国总统李在明周二表示，有迹象显示部分黑客事件中使用了人工智能，并呼吁加强网络安全措施。
South Korean President Lee Jae Myung said on Tuesday that signs had emerged that AI was used in some of the hacking incidents and called for heightened cybersecurity measures.