AI‑Driven Intrusion Campaign Hits South Korean Financial Firms, Data Stolen

South Korean financial institutions faced a coordinated breach in late September and early October 2026, when a financially motivated group leveraged advanced, agentic artificial intelligence tools to infiltrate networks and extract confidential information.

The operation, uncovered by security researchers at GBHackers, combined the open‑source penetration testing framework ARTEX—originally developed in China—with self‑directing AI scripts that automated reconnaissance, credential harvesting, and lateral movement across multiple targets. Investigators say the campaign unfolded over a ten‑day window, during which attackers accessed internal databases, transaction logs, and client records before covering their tracks.

ARTEX provides a modular suite of exploits that can be customized for specific environments. In this case, the attackers integrated generative AI models capable of interpreting system responses and adjusting tactics in real time, effectively creating a semi‑autonomous hacking agent. The AI component identified vulnerable services, generated tailored phishing payloads, and even crafted code to bypass multi‑factor authentication, reducing the need for human oversight and speeding up the exfiltration process.

Preliminary assessments suggest that at least three major banks and two securities firms were compromised, with millions of records potentially exposed. While the full scope of the data loss remains under investigation, the breach is believed to include personal identifiers, account numbers, and transaction histories, raising concerns about identity theft and fraud targeting both domestic and overseas customers.

South Korea's Financial Services Commission has launched an emergency response, urging affected institutions to isolate compromised systems, rotate credentials, and notify customers in accordance with data‑protection regulations. The incident also prompted a joint advisory from the Korea Internet & Security Agency (KISA) and the Ministry of Science and ICT, warning that the fusion of open‑source tools with AI could lower the barrier to entry for financially driven cybercrime groups.

Cybersecurity experts caution that the attack exemplifies a broader shift toward AI‑augmented threat actors who can scale operations with minimal manual effort. As governments and private firms grapple with the rapid evolution of such tactics, calls for stronger AI governance, tighter control of open‑source exploit kits, and enhanced threat‑intelligence sharing are expected to intensify in the months ahead.