[Anchor]

New clues have been found to track the identity of hackers who have launched consecutive attacks on domestic financial institutions. A U.S. cybersecurity firm has secured artificial intelligence chat logs from a server used in the attacks, which contained personal information of a 26-year-old Chinese national.

Reporter Choi Seung-hun has the details.

[Reporter]

This is an IP address suspected of being used in the successive attacks on domestic financial institutions.

U.S. cybersecurity firm CrowdStrike has captured circumstances indicating that a Chinese-developed artificial intelligence and AI penetration testing tool, "Artext," operated on a server using this address.

Written on the server were instructions directing the AI in Chinese to perform hacking-related tasks, along with the IP address of another server located in Hong Kong.

Tracing this address revealed chat logs with "Claude Code," a program-building AI, as well as hacking program configuration files.

This made it possible to look into the conversations exchanged between the hacker and the AI.

There were also inquiries asking where information leaked from South Korea is traded and how to find related Telegram groups.

However, another conversation revealed a request to "write a resume needed to apply for a security researcher position."

The information provided by the hacker to be included in the resume contained a name "YY," a Chinese mobile phone number, a Telegram account, along with an age of 26, residence in Guangdong Province, China, and educational background from South China University of Technology.

This Telegram account appeared once more during discussions with Claude Code regarding another hacking incident.

CrowdStrike raised the possibility that this information is related to the attacker's identity.

However, it could not definitively conclude whether it is the actual attacker's identity, as the listed age and date of birth do not match each other.

[Hwang Seok-jin / Professor, Graduate School of Information Security, Dongguk University: I judge that the technical analysis has considerable reliability, but given that usage records and attack infrastructure have been secured, final verification by investigative authorities seems necessary....]

CrowdStrike analyzed that the attacker is not a skilled hacker, stating, "We do not believe they could have carried out an attack of this scale alone without AI."

(Video editing: So Ji-hye, Design: Jeon Yu-geun)