Authorities in South Korea have identified seven individuals connected to a cybercrime scheme that infiltrated over 90 organizations within the nation, with the ARTEX AI pentesting framework being employed in the majority of the attacks.
As reported by local media referencing the Seoul Metropolitan Police, the leader of the group has experience in penetration testing and was employed at a cybersecurity firm from 2019 to 2022.
In 38 of the cases, the perpetrator demanded ransom payments totaling 360 million won ($270,000), assuring victims that the stolen data would not be disclosed in return.
Officials suspect that the threat actor pilfered 8.2 million records from various compromised entities, which included educational institutions, hospitals, major corporations, and even golf courses.
According to Yonhap News, the gang leader is a self-taught hacker aged 32 who began targeting organizations in September 2025.
The Seoul Metropolitan Police informed the publication that the hacker utilized the ARTEX AI penetration testing suite, the same autonomous framework linked to attacks on several South Korean banks attributed to a Chinese-speaking cybercriminal.
Initially, the hacker relied on traditional tools but transitioned to AI utilities in late August 2026 to enhance the scope of the attacks.
Law enforcement apprehended all seven suspects, but only the leader remains in custody. He was arrested on October 15, formally detained two days later, and referred to prosecutors on October 23. The other six suspects are still under investigation but have not been detained.
The police initiated a case following a victim’s complaint in June, and investigators tracked the suspects through server logs from the compromised organizations.
Reportedly, law enforcement utilized an internal AI tool to analyze the evidence that was recovered.
The police stated to local media that AI has made it easier for aspiring cybercriminals to engage in large-scale, impactful incidents that were previously only achievable by skilled and knowledgeable individuals.
“This marks the first instance of an arrest in Korea related to a significant hacking and personal information theft crime that leveraged generative AI,” the police told Yonhap.
“Now, even those who are not part of professional hacking organizations can conduct large-scale hacks with the assistance of AI.”
The investigation is ongoing, with a current focus on determining whether any of the stolen data has been released on the dark web.
Once attackers possess valid credentials, only 37% of their actions are thwarted.
Overall prevention metrics can obscure what occurs after initial access. Once attackers gain valid credentials, prevention effectiveness declines significantly.
The Blue Report 2026 evaluates defense techniques through 338 million simulations conducted in customer production environments.
Access the report.
Source: Original article
