South Korean authorities are calling for a comprehensive revision of cybersecurity protocols following a series of breaches that compromised seven major financial institutions last week. The attacks resulted in the exposure of personal data belonging to approximately 68,000 customers, prompting Prime Minister Han Seong-sook to declare the situation critical and demand swift action to prevent further leaks.
The scope of the incident extends beyond banking. On Wednesday, two of the nation’s largest churches and Korea Electric Power Corp. confirmed that their online systems had been illegally accessed. While it remains unclear if the same group is responsible for all intrusions, officials warn that the tactics employed could spread to government and public sectors.
At a Cabinet meeting, Prime Minister Han highlighted the novel use of artificial intelligence in the cyberattacks. “This is a serious situation because this incident is believed to have taken advantage of artificial intelligence,” Han stated, according to Yonhap News. “If AI is used in phishing attacks, it could lead to secondary damage. It is also a serious situation in that similar hacking methods could spread beyond the financial sector to industries, as well as government and public sectors.”
Initial assessments from CrowdStrike suggested the attacks may have originated in China, but the Financial Supervisory Service (FSS) identified 28 IP addresses linked to the breaches across the United States, Japan, Germany, and at least ten other countries. Logs from the attacked banks revealed traces of ARTEX, an open-source autonomous penetration-testing agent developed in China. However, experts caution that the tool’s origin does not necessarily implicate Chinese actors.
“Officials have said explicitly that a Chinese-built tool doesn’t mean Chinese attackers,” Aditya Das of Brave New Coin told DW. He noted that the use of multiple international IP addresses is likely a tactic to obscure the hackers’ true locations.
The breaches exploited weak authentication in auxiliary systems, including portals for external loan recruiters, employee mobile applications, and sales-support tools. According to media reports, the stolen data includes names, phone numbers, annual income, loan limits, loan products, and a small number of national identification numbers.
Hyobin Lee, a professor at Sogang University, emphasized that the risk extends beyond simple data exposure. “If criminals obtain such information, they may be able to carry out sophisticated financial fraud, identity theft, or highly targeted phishing attacks,” Lee said. She warned that scammers could use the detailed financial profiles to make fraudulent “bank security” calls appear convincing, making it difficult for victims to recover transferred funds.
Lee also pointed out that while major banks have invested heavily in securing core platforms like internet banking, they have neglected secondary systems. Furthermore, she noted that generative AI is lowering the technical barriers to cybercrime. “Today, generative AI tools can assist with writing computer code, analyzing software vulnerabilities, processing large amounts of information and automating certain stages of cyber operations,” she explained.
As AI-assisted attacks become more frequent and scalable, Lee warned that hospitals, energy infrastructure, telecommunications networks, and other organizations holding sensitive information may increasingly become targets.
Does anyone else find it suspicious they blamed ARTEX so quickly? Maybe just a convenient scapegoat.
It’s ironic that banks secure main systems but ignore auxiliary portals. Lazy security practices everywhere.
Sixty-eight thousand people affected! This shows how dangerous AI-assisted phishing really is now.