Summary
Seoul Metropolitan Police say a seven-person group used generative AI tools to breach roughly 90 organizations in South Korea, stealing about 8.2 million personal and internal records. Reporting names the ARTEX AI pentesting framework as the main tool in most attacks.
What Police Say Happened
- Victims: Hospitals, private academies and businesses.
- Extortion: In 38 incidents the attackers demanded ransom, reportedly 360 million won (about $270,000), promising not to leak the data.
- Leader: A self-taught 32-year-old with a penetration-testing background who worked for a cybersecurity company from 2019 to 2022. Attacks began in September 2025.
- Tooling: He started with website vulnerability scanners, then added an AI coding agent and an autonomous penetration-testing system. From August 31 to October 13 he allegedly breached 60 companies in 44 days.
- Link to bank attacks: Police said ARTEX is the same autonomous framework seen in earlier attacks on South Korean banks attributed to a Chinese-speaking actor. One outlet notes ARTEX's exact role remains unverified.
Legal Status
All seven were arrested. Only the leader remains in custody: arrested October 15, formally detained two days later and referred to prosecutors October 23. The others remain under investigation. Charges include violations of the information protection act and extortion. The case began with a victim complaint in June, and police traced the group through server logs. They are checking whether any stolen data has surfaced on the dark web.
Why It Matters
The case shows how autonomous offensive tooling compresses an attacker's workload: one person breaching 60 companies in 44 days. Defenders should assume exposed web apps are scanned and exploited at machine speed.
Recommendations
- Patch internet-facing web applications and remove unused ones.
- Enforce MFA and rotate credentials on exposed services.
- Centralize and retain server logs; they were the key to attribution here.
- Monitor for extortion notes and leaked-data claims naming your organization.