Former pentester used ARTEX AI to steal data from South Korean firms

South Korean police have identified seven suspects linked to a cybercrime group that breached more than 90 organizations across the country and stole 8.2 million data records. BleepingComputer and Mezha.net both report that the gang used the ARTEX AI penetration testing framework in most of the cyberattacks. Local media reports citing the Seoul Metropolitan Police state that the leader of the group is a former cybersecurity consultant who worked in penetration testing between 2019 and 2022. [1][2]

In 38 of the security incidents, the group demanded ransom payments totaling 360 million won, which is approximately 270,000 United States dollars. BleepingComputer reports that the attackers promised to restore access or hold back stolen data in exchange for the payments. [1]

As FTMQ Security reported earlier, the ARTEX AI framework was previously used alongside Claude agents to compromise major South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. Those earlier attacks exposed personal customer data and caused system outages, leading the tool developer to make ARTEX AI closed source. [6]

South Korean law enforcement authorities are continuing their investigation into the seven suspects identified in connection with the cybercrime operation. [1]