When people picture a cyberattack, they often imagine a small group of highly skilled hackers staring at screens of code, spending weeks working out how to break through a defence.
As AI becomes part of the attack workflow, businesses need to reconsider how much time they have to respond.
In October, CrowdStrike published an investigation into a campaign targeting South Korean financial organisations. Researchers found Claude Code session histories and configuration files for the AI penetration-testing tool ARTEX on attacker-controlled infrastructure. The findings show AI tools being used alongside conventional offensive techniques. Data was exfiltrated, although the total number of affected organisations remained unconfirmed.
It would be easy to reduce the story to a headline: “You can break into a bank without knowing how to code.”
The public evidence does not establish that the attacker had no technical background. A more useful signal for businesses is that AI can help attackers work faster, compressing activities that might otherwise require more time and people. CrowdStrike also points to the potential for these tools to accelerate multiple intrusions.
For small and medium-sized businesses, that has a direct implication: an issue marked “we will deal with it later” may offer less breathing room than expected.
A website plugin nobody is updating, an administrator account still active after an employee leaves, or a system entry point left open after testing all deserve a review. These are illustrative business-management scenarios, not confirmed entry points in the South Korean case. They share a familiar problem: when a system keeps working, unresolved issues can remain in place.
Imagine a website update notification appearing for several weeks. The content team assumes IT will handle it. IT assumes the supplier is responsible. Only after an incident does everyone discover that nobody actually owned the task.
As AI accelerates parts of an attack, that gap in responsibility deserves closer attention.
Businesses can start with concrete questions. Who owns each internet-facing system? How quickly must security updates be applied? Who can immediately disable an account after suspicious activity? Has anyone actually tested restoring a backup?
The answers help determine whether a company can contain an incident quickly or first needs days to find the right person, locate passwords and contact the supplier who built the website.
AI can assist employees, and it can assist attackers. As businesses use it to improve productivity, system maintenance and response arrangements need to keep pace.
The next time an update notification arrives, a useful question is: if someone exploited this issue today, would we be ready?
Source: CrowdStrike | AI-driven ARTEX targets South Korean finance. This article includes independent editorial analysis by SRAM.
Author: SRAM