Hacker group TAG217 prepped South Korean bank attacks in August

A hacker group tracked as TAG-217 began assembling attack tools and testing infrastructure in August 2026, weeks before executing cyberattacks against South Korean financial institutions, Recorded Future reported. The intrusions compromised at least seven financial organizations and exposed the personal data of at least 68,000 people. [1][5]

Recorded Future and FTMQ Security both report that the attacks utilized the artificial-intelligence-driven ARTEX framework. Research from Recorded Future revealed that TAG-217 also developed tools specifically created to steal cryptocurrency wallet files during the campaign. [1][4][5]

As FTMQ Security reported earlier, a Chinese-speaking hacker deployed the ARTEX framework alongside Claude agents to compromise major institutions, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The breaches exposed personal client information and credit card details, while also causing operational system outages. [4]

Following these security incidents, South Korea's five largest commercial banks increased their combined information security spending to 332 billion won, FTMQ Security reported previously. This budget represents a 3.8 percent increase compared to the previous year as institutions work to secure their networks. [5]