INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Solo Hacker Uses AI Tools to Breach South Korean Institutions

| 2026-10-08 12:56 CRITICAL HIGH AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
A recent incident of cyberattack targeting Korea's financial sector involved the use of AI-based threat detection to detect abnormal behavior in data breaches. The attack, which occurred on October 7th and was announced on the 8th, is believed to have been carried out by a solo hacker who used AI tools to breach multiple financial organizations. According to Citi AI Lab's analysis, the attacker attempted to embed an internal server into a proxy botnet by communicating with an external malicious IP address, highlighting the potential for AI-based attacks to lead to personal data leaks and more severe crimes. The attack was detected through abnormal DNS traffic that deviated from normal communication patterns, suggesting that early detection is crucial in preventing such incidents.
Technical Mitigations AI-generated
• Pre-compromise (ATT&CK mitigation for Botnet): This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 12 IoCs Create Free Account
154.201.•••.•••
209.209.•••.•••
38.244.•••.•••
103.248.•••.•••
hxxp://••••••••••••••••••••
xc•••••.pro
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Cyclops BlinkCyclops Blink
Target & Sectors
LATAM LATAM NORTH_AMERICA NORTH_AMERICA governmentgovernment financefinance automotiveautomotive mediamedia
Incident Timeline
‎July 7
CrowdStrike Intelligence released a report on July 7 identifying the infrastructure related to attacks on Korean financial institutions from September 2026 to early October 2026.
attribution CrowdStrike Intelligence
According to the report released by CrowdStrike Intelligence on July 7, the company identified the infrastructure related to the attacks on Korean financial institutions from September 2026 to early October 2026.
‎August 27th
Threat actors exploited a vulnerability in the 29CM sister company's external API to retrieve order information on August 27th, resulting in the exposure of 159,852 customer personal data records.
tactic Data Breach
The 29CM sister company, 29CM, recently experienced a data breach incident where an external API request to retrieve order information on August 27th resulted in the exposure of 159,852 customer personal data records.
organisation API
The 29CM sister company, 29CM, recently experienced a data breach incident where an external API request to retrieve order information on August 27th resulted in the exposure of 159,852 customer personal data records.
data_breach 159,852 data records
The 29CM sister company, 29CM, recently experienced a data breach incident where an external API request to retrieve order information on August 27th resulted in the exposure of 159,852 customer personal data records.
‎September 4th
Threat actors exploited a consultation record API to gain unauthorized access, resulting in the exposure of approximately 220,000 personal data records.
data_breach 220,000 personal data records
On September 4th, a consultation record API revealed unauthorized access, resulting in the exposure of approximately 220,000 personal data records.
‎September 2026
CrowdStrike Intelligence identified the infrastructure related to attacks on Korean financial institutions from September 2026 to early October 2026.
attribution CrowdStrike Intelligence
According to the report released by CrowdStrike Intelligence on July 7, the company identified the infrastructure related to the attacks on Korean financial institutions from September 2026 to early October 2026.
‎Sept. 14
An unidentified hacker used a well-known language model to breach corporate personal data stores of an unnamed Korean financial institution.
target_region Spain
On Sept. 14, Spain's Data Protection Agency (AEPD) — the Spanish government's data protection watchdog — described a breach report submitted by an unnamed organization, in which an unidentified hacker used a "well-known language model" to breach corporate personal data stores.
industry Government
On Sept. 14, Spain's Data Protection Agency (AEPD) — the Spanish government's data protection watchdog — described a breach report submitted by an unnamed organization, in which an unidentified hacker used a "well-known language model" to breach corporate personal data stores.
attribution Data Protection Agency
On Sept. 14, Spain's Data Protection Agency (AEPD) — the Spanish government's data protection watchdog — described a breach report submitted by an unnamed organization, in which an unidentified hacker used a "well-known language model" to breach corporate personal data stores.
‎2026/09/18
Threat actors exploited vulnerabilities in a Korean financial institution's AI system to leak sensitive information.
target_region Korea, Republic of
" Related: Cyber Op Targets South Korean Media & Automotive Sectors Are Agentic Attacks Already Old News? Stories of AI-driven cyberattacks might leave one feeling less shocked today than they did earlier in 2026.
industry Media
" Related: Cyber Op Targets South Korean Media & Automotive Sectors Are Agentic Attacks Already Old News? Stories of AI-driven cyberattacks might leave one feeling less shocked today than they did earlier in 2026.
industry Automotive
" Related: Cyber Op Targets South Korean Media & Automotive Sectors Are Agentic Attacks Already Old News? Stories of AI-driven cyberattacks might leave one feeling less shocked today than they did earlier in 2026.
organisation Media & Automotive
" Related: Cyber Op Targets South Korean Media & Automotive Sectors Are Agentic Attacks Already Old News? Stories of AI-driven cyberattacks might leave one feeling less shocked today than they did earlier in 2026.
‎September 28
An unidentified attacker attempted to exploit vulnerabilities and steal information on September 28.
‎2026/10/02
An unidentified attacker attempted to exploit vulnerabilities and steal information on September 28.
‎October 2
The Financial Security Institute stated on October 2 that a widespread attack using AI autonomous intrusion tools is underway against domestic financial institutions.
organisation the Financial Security Institute
Shinhan Bank, following 29CM and Gangnam Sister, has also experienced a customer information leak incident, with the Financial Security Institute stating on October 2 that a widespread attack using AI autonomous intrusion tools is actually underway against domestic financial institutions.
‎2026/10/08
A suspected lone threat actor used an AI-powered penetration-testing tool called ARTEX to breach several South Korean financial organizations and steal customer and employee data.
organisation FamousSparrow APT Spies
Related: China's FamousSparrow APT Spies on US Politics in Latin America It was never going to take long for this prediction to become reality in Spain itself.
organisation US Politics
Related: China's FamousSparrow APT Spies on US Politics in Latin America It was never going to take long for this prediction to become reality in Spain itself.
organisation ARTEX
A suspected lone threat actor used an AI-powered penetration-testing tool called ARTEX to breach several South Korean financial organizations and steal customer and employee data.
The server was running ARTEX, and a publicly available directory revealed a Claude Code instruction document.
[Issue Analysis] ARTEX's Widespread Attack on Financial Sector, Shinhan Bank, and Gangnam Sister, Misa, Also Affected... 'API Permission Verification' Vulnerability Exploited by AI.
organisation Widespread Attack
[Issue Analysis] ARTEX's Widespread Attack on Financial Sector, Shinhan Bank, and Gangnam Sister, Misa, Also Affected... 'API Permission Verification' Vulnerability Exploited by AI.
organisation Shinhan Bank
[Issue Analysis] ARTEX's Widespread Attack on Financial Sector, Shinhan Bank, and Gangnam Sister, Misa, Also Affected... 'API Permission Verification' Vulnerability Exploited by AI.
organisation Vulnerability Exploited
[Issue Analysis] ARTEX's Widespread Attack on Financial Sector, Shinhan Bank, and Gangnam Sister, Misa, Also Affected... 'API Permission Verification' Vulnerability Exploited by AI.
organisation Cyber Security News
The case shows how open-source AI tools can help […] The post Solo Hacker Used AI Tools to Breach South Korean Financial Organizations and Steal Data appeared first on Cyber Security News .
organisation LLM
The document included a Chinese prompt specifying the method for LLM to perform intrusion testing and a Hong Kong-based IP address controlled by the attackers.
organisation CrowdStrike
CrowdStrike has conducted additional analysis of the Hong Kong-based server and secured the Cloud Code session records, ARTEX configuration files, and Cloud Memory files.
organisation IP
The investigation into the primary attacking IP revealed that the ARTEX, a Chinese-based open-source AI autonomous intrusion tool, was running on the infrastructure, and further analysis of the same IP's access history confirmed that the attacker had attempted to conduct infiltration attacks against multiple domestic financial institutions.
The analysis began with the IP address associated with the attack, '38.244.50[.]120'.
A representative example cited was the detection of abnormal DNS traffic that attempted to embed an internal server into a proxy botnet by communicating with an external malicious IP address.
organisation Telegram
The attacker asked the victim about where Korean leaked data is primarily sold, and requested help in finding a Korean-related data-selling Telegram group.
organisation CloudStrike
CloudStrike evaluated this case as showing that an attacker using AI tools can carry out multiple breaches within a short period of time for financial motives.
organisation CTI Lab's
CTI Lab's latest analysis compared the attack stages and features of its in-house detection model with those publicly disclosed by Citi AI Lab.
organisation DNS
The company stated that it currently applies over 20 types of threat detection models to various areas, including web, network, VPN, and DNS.
organisation CTI
CTI Lab Representative Cho Hong-yeon stated that "this financial sector attack can be analyzed as a normal operation learned by the AI model, allowing detection of personal information leaks before they occur, in the repeated review stage."
organisation Agentic Data Breach
Profile of an Agentic Data Breach In June, Spain's National Cryptologic Center (CCN) published a report warning about the "paradigm shift" malicious AI represents for cybersecurity.
organisation National Cryptologic Center
Profile of an Agentic Data Breach In June, Spain's National Cryptologic Center (CCN) published a report warning about the "paradigm shift" malicious AI represents for cybersecurity.
organisation CCN
Profile of an Agentic Data Breach In June, Spain's National Cryptologic Center (CCN) published a report warning about the "paradigm shift" malicious AI represents for cybersecurity.
organisation the Korea Internet & Security Agency
29CM promptly identified the incident and blocked the affected access route, reporting it to the Korea Internet & Security Agency (KISA).
organisation KISA
29CM promptly identified the incident and blocked the affected access route, reporting it to the Korea Internet & Security Agency (KISA).
organisation Bank
Shinhan Bank's loan recruitment inns can access their own loan processing status through the mobile website 'M Shinhan'.
organisation Red Team
According to a Red Team insider who is familiar with the financial sector, "Unlike installing malicious code on the server or executing abnormal commands, an attacker can enter a service that appears to be open normally and change only the request value, which can be detected as a normal connection by network monitoring systems.
data_breach 138,841 records
Out of these, 138,841 records contained names, while 21,011 records contained names and email addresses, phone numbers, delivery information, and more.
data_breach 21,011 records
Out of these, 138,841 records contained names, while 21,011 records contained names and email addresses, phone numbers, delivery information, and more.
victims 20,0005 customer information
Shinhan Bank has estimated that approximately 20,0005 thousand customer information was leaked, and the financial authorities and the Financial Security Institute are investigating the cause of the incident.
organisation CTO
Gene Moody, field chief technology officer (CTO) at Action1, notes how obvious it is that AI already has the capability, and that hackers en masse are inevitably starting to take advantage.
organisation Spanish Organization
AI Agent Breaches Spanish Organization, Modifies Personal Data.
organisation Modifies Personal Data
AI Agent Breaches Spanish Organization, Modifies Personal Data.
organisation Above Security
In this new reality, where autonomous systems can chain familiar cyberattack steps together without a human manually driving every stage, "That changes the defender’s time horizon," says Aviv Nahum, co-founder and CEO at Above Security.
‎early October 2026
CrowdStrike Intelligence identified the infrastructure related to attacks on Korean financial institutions from September 2026 to early October 2026.
attribution CrowdStrike Intelligence
According to the report released by CrowdStrike Intelligence on July 7, the company identified the infrastructure related to the attacks on Korean financial institutions from September 2026 to early October 2026.
Tactical Metrics
Metrics
data_breach
159,852
Data Records
The 29CM sister company, 29CM, recently experienced a data breach incident where an external API request to retrieve order information on August 27th resulted in the exposure of 159,852 customer personal data records.
Metrics
data_breach
220,000
Personal Data Records
On September 4th, a consultation record API revealed unauthorized access, resulting in the exposure of approximately 220,000 personal data records.
Metrics
data_breach
138,841
Records
Out of these, 138,841 records contained names, while 21,011 records contained names and email addresses, phone numbers, delivery information, and more.
Metrics
data_breach
21,011
Records
Out of these, 138,841 records contained names, while 21,011 records contained names and email addresses, phone numbers, delivery information, and more.
Metrics
victims
200,005,000
Customer Information
Shinhan Bank has estimated that approximately 20,0005 thousand customer information was leaked, and the financial authorities and the Financial Security Institute are investigating the cause of the incident.
Intelligence Sources
Dark Reading 2026-09-18
Dailysecu 2026-10-02
Dailysecu 2026-10-08
Dailysecu 2026-10-08
AlienVault OTX 2026-10-08