CrowdStrike: news, timeline and key numbers

CrowdStrike Intelligence published an analysis of an unidentified, financially motivated attacker who targeted South Korean financial organizations between late September and early October 2026. The attacker successfully exfiltrated data. Investigators found open directories holding Claude Code session histories, configuration files and memory logs. These showed the attacker used ARTEX, an open-source Chinese tool for autonomous penetration testing, together with large language models.

Days later, the F.B.I. worked with CrowdStrike to shut down more than 40 laptop farms across Texas and confiscate nearly 200 devices. The farms were part of a scheme that funneled U.S. remote work wages to North Korea. Federal authorities also unsealed indictments in Ohio against two Americans and ten China-based North Koreans. They are accused of stealing identities to siphon over $3 million from 70 unsuspecting employers between 2019 and 2025.

Later in October, CrowdStrike researchers reported that four previously unreported hacking groups had used agentic AI to run successful attacks between May and August. The findings suggest that even less skilled criminals can use AI to compromise real targets. Built-in guardrails are not reliably stopping them.

Oesnada lists every published story that names this subject. A subject gets a page once at least three stories mention it. Subjects are identified automatically from story text. Importance is an automated score from 0 to 100 assigned to each story; it is a model judgement, not a measurement. The summary above is written by a language model from Oesnada summaries only and regenerates when a new story arrives.