The AI-Driven Cyberattack Wave Shaking South Korea's Financial Sector
In just over a month, South Korea has witnessed what experts are calling one of the most coordinated and technologically sophisticated cyberattacks ever directed at the country's financial sector. The new wave, which struck brokerages, asset managers and crypto exchanges, extends a pattern that began in September with commercial banks and spread like an oil stain throughout the country's financial services chain.
What makes these attacks particularly alarming is not just the volume — around 100,000 personal data records confirmed compromised so far — but the method. Evidence pointed to the use of ARTEX, an open-source agentic penetration testing tool developed in China, combined with large language models (LLMs) such as Claude, DeepSeek, and Grok. The result: a single hacker, apparently operating from China, capable of breaching multiple financial institutions in an extremely short period.
The attacks expand
The new wave of attacks, confirmed on October 28, hit brokerage Daishin Securities, which reported the exposure of personal and financial data belonging to 38,490 customers, including names, email addresses, and phone numbers. Mirae Asset Global Investments and cryptocurrency exchange Bithumb also confirmed intrusions, although neither has admitted to customer data loss.
The original wave from September had affected 16 financial institutions, including Shinhan, KB Kookmin, and Hana Bank, as well as savings cooperatives, capital companies, mutual financial institutions, electronic financial service providers and virtual asset service providers. The compromised systems were not the banks' core deposit and transfer processing systems, but rather ancillary services — a lookup system for loan brokers, an internal sales support system for employees, an external mutual aid webpage.
Bank BNK Busan Bank reported that attackers bypassed standard authentication on a loan inquiry service, exposing financial information of approximately 25,000 people. Hana Bank saw 89 customer records exposed in its employee sales support system, separated from internet and mobile banking. Shinhan Bank confirmed the breach in a service used by loan agents to check application status.
The Financial Supervisory Service (FSS) dispatched inspectors to affected firms and is conducting security checks on dozens of IT systems in the private sector. FSS Governor Lee Chan-jin summoned the CEOs of eight major banking groups to strengthen cyber defenses.
ARTEX's role
ARTEX is an agentic penetration testing tool developed in China that uses autonomous AI agents to automate vulnerability discovery and system exploitation. When the project was discovered in real-world use against financial institutions, its developer made it closed-source and discontinued updates — but the already-available version spawned English- and Korean-language derivatives that continue to circulate.
According to CrowdStrike, which investigated the case, the attacker connected ARTEX to several LLMs, including DeepSeek v4.1-flash as the primary backend, GLM-5.3 (from Zhipu AI), and Grok 4.6 for additional sessions. The attacker accessed DeepSeek likely through the Chinese LLM API proxy/reseller xcai.pro.
The attacker's infrastructure was analyzed: IP 38.246.50.120 hosted an ARTEX instance and an open directory containing Claude Code session histories, ARTEX configuration files, and Claude memory files. A Chinese-language markdown document specified how the LLM should conduct pentesting activities. The attacker used Claude itself to create a security researcher resume with bullet points about ARTEX activity results — including a fictional name "YY," a Chinese phone number, and a Telegram handle.
AhnLab (ASEC) analysis confirmed that the attacks did not target core deposit and transfer processing systems, but rather services connected to main services: broker loan lookup, internal sales support, external web pages. The same analysis noted that the same attack pattern — exploiting auxiliary systems connected to the internet — was observed in other countries, including Japan, the United States, Europe, and South America, in large-scale attacks using AI agents.
Why this matters
The South Korea attacks represent a turning point in the evolution of cybercrime. For the first time, we have concrete evidence of an individual hacker using agentic AI tools to conduct a multi-institutional intrusion campaign against the financial sector of a developed country.
AhnLab warned that the attack was not confined to the financial sector: it also affected corporate accounting software providers, a large church, universities, e-book services, cloud providers, and a franchise company. In Japan, GMO Cybersecurity identified evidence of the same ARTEX being used in attacks on Japanese companies, with eight organizations reporting breaches in September and October.
The fundamental question that emerges is straightforward: when the technical barrier to conducting sophisticated attacks falls to the level of configuring an LLM via API and connecting a tool like ARTEX, how many systems can still be considered secure? The attacker who operated against the Korean financial sector did not need reverse-engineering knowledge or zero-day exploits — they needed access to AI models and patience.
What will the future of cybercrime look like when every attacker has access to the analytical power, automation, and adaptability that ARTEX offered — even in its already-discontinued version?
Sources: TechCrunch, AhnLab ASEC, CrowdStrike, BleepingComputer
✓ Independent sources cross-checked and verified before publishing
