South Korea financial sector faces second wave of AI-driven cyberattacks
South Korea is confronting an alarming escalation in cyberattacks against its financial sector, with a second wave of intrusions recorded less than a month after the initial devastating attack in September. This time, victims include brokerage firm Daishin Securities, with 38,490 customers affected, as well as Mirae Asset Global Investments and the cryptocurrency exchange Bithumb.
The crisis began on October 2, when South Korea three largest commercial banks — Shinhan Bank, KB Kookmin Bank, and Hana Bank — were targeted in coordinated intrusions. By October 14, the number of affected institutions had jumped to 16, with approximately 100,000 personal records exposed, according to the Financial Supervisory Service (FSS).
The technology behind the attacks
What makes these attacks particularly alarming is the use of AI-powered autonomous penetration testing tools. Investigators found traces of ARTEX, an open-source Chinese tool developed by Li Puhua — known as "Autumn" — that automates vulnerability discovery and attack vector generation.
ARTEX connects to AI models from companies including DeepSeek, OpenAI, and Anthropic, allowing multiple AI agents to analyze targets and plan intrusion routes with minimal human input. One agent can scan systems for weaknesses, adjust its approach based on findings, and then move to the next target without human intervention.
According to CrowdStrike, the attacker used DeepSeek V4.1-Flash as the primary backend for ARTEX, along with Zhipu AI GLM-5.3 and Grok 4.6 in separate Claude Code sessions. A resume file found in Claude Code sessions suggested the attacker might be a 26-year-old male who studied at the South China University of Technology in Maoming, Guangdong.
Why banks could not stop them
Unlike the largest cyberattacks of the past, which compromised core transaction systems, the recent attacks exploited peripheral systems used by employees, loan agents, and third parties — entry points with relatively weak security.
Shinhan Bank spent approximately 2 million on information security last year, but even that substantial investment could not protect its supporting systems. The attackers did not need to force the front door: they found a window left open.
Professors at Seoul National University and Dongguk University noted that the combination of exposed data — name, phone number, annual income, and loan limit — is especially dangerous. "A phone number alone has limited value, but when criminals can connect it to someone income and potential loan limit, they gain enough context to create a highly convincing scam," explained Sung-ho Hwang, Nord Security regional manager.
South Korean President Lee Jae Myung admitted in a cabinet meeting that "in some hacking incidents, signs have emerged of AI being used," and ordered resources to be concentrated on minimizing damage.
The systemic risk
South Korea is not alone. One day earlier, Japan reported a cybersecurity incident involving GMO Internet, following a series of attacks on its financial institutions. Investigators have not yet established a connection between the incidents, but the wave of cyberattacks across Asia underscores growing cybersecurity challenges in the sector, often the result of years of inadequate basic cybersecurity.
FSC Chairman Lee Eog-won acknowledged that the government initial response to AI-assisted attacks was "inadequate in several basic areas." The regulator is considering easing network separation rules to allow financial institutions to use AI more actively in defense.
The message from experts is clear: as attackers use AI to find vulnerabilities at unprecedented speed and scale, defenders need to adopt the same level of automation. What worked five years ago — manual reviews, monthly patching, human monitoring — is already insufficient against AI agents that operate 24 hours a day.
Sources: TechCrunch, Bleeping Computer, The Korea Times
✓ Independent sources cross-checked and verified before publishing
