The Korean National Police Agency has opened a formal cooperation channel with the U.S. Federal Bureau of Investigation to obtain account and access logs from American cybersecurity and AI vendors, pursuing leads in a cross-border intrusion campaign that hit domestic financial institutions this autumn.
Investigators want records from firms that hosted tools the attackers used, including coding assistants that stored resume fragments CrowdStrike analysts linked to a 26-year-old man in Guangdong province. The man told Chinese media his phone number was stolen and denied involvement; Seoul detectives are treating that denial as unverified.
Why attribution is contested
Police are reviewing CrowdStrike's methodology alongside documents suggesting ties to a Chinese distributed denial-of-service proxy group. A senior officer declined to confirm whether the FBI has already returned data, citing partner-country sensitivities. Financial regulators separately asked banks to preserve firewall images from the affected window.
The case matters because earlier AI-linked banking intrusions triggered a 28-detective task force in October. If the same infrastructure reused U.S. SaaS accounts, Korean warrants alone would not reach the logs—hence the FBI route.
Institutional response
Banks tightened multi-factor rules for vendor VPNs on Monday, and the Financial Security Institute circulated a checklist for monitoring WebLogic scans that preceded past breaches. Consumers saw no new transfer limits, but phishing warnings reappeared in mobile apps citing the investigation.
Legal scholars noted that relying on private threat intelligence as probable cause is still novel in Korean courts. Prosecutors may need corroborating domestic packet captures before any indictment, especially if U.S. firms resist broad log pulls.
What happens next
Detectives said they would brief the National Assembly's science committee if cooperation stalls. For account holders, the immediate risk is secondary fraud using data gleaned from earlier dumps, not another outage. Police urged customers to ignore text messages claiming to freeze accounts pending FBI interviews—a scam pattern that often follows real headlines.
Cross-border legal friction
Defense attorneys said U.S. cloud firms may resist broad log requests without narrowly tailored warrants. Korea's mutual legal assistance treaty with the United States covers criminal cases but can add months of delay. Prosecutors are weighing whether to open a parallel complaint with China's cyber administration, though diplomatic channels remain cold.
Meanwhile, banks ran tabletop exercises simulating credential theft via AI coding assistants, a threat vector that did not exist in last year's playbooks. Employees were told not to paste proprietary code into public chat models, echoing guidance from the Financial Security Institute after earlier leaks.
Vendor cooperation norms
CrowdStrike and peers typically require Korean warrants that mirror U.S. probable-cause standards before releasing tenant logs. Police liaison officers in Washington may expedite requests if the case is framed as financial-system stability, but tech lawyers said each vendor's terms of service still govern.