Seven Institutions After ARTEX AI: What South Korea's Banks Changed, and What's Still a Promise

Beginning September 28, 2026, an attacker used an open-source AI penetration-testing tool called ARTEX to break into seven South Korean financial institutions over roughly one week. Regulators have since identified 16 financial companies as victims of the intrusions, with roughly 100,000 records compromised (7). The seven institutions identified in the first wave of disclosures include four banks, Shinhan, KB Kookmin, Hana, and BNK Busan, along with two savings banks, Yegaram and Welcom, and the finance company Hyundai Capital (2). Two more major banks, Woori and NH NongHyup, were probed by the same attacker and did not fall (1).

The Wall Street Journal described the campaign as one of the first AI-powered intrusions into the global financial system (3). The question worth asking two weeks later is narrower: what did these institutions actually change about their security, and can any of it be verified?

The documented answer splits in two. On one side sits a regulatory record that is unusually specific for an incident this young: an inspection of 555 financial companies that found deficiencies at 130 of them, a recommended comprehensive audit of employee-facing systems, a commitment to vulnerability assessments at least twice a year at large firms, and a police investigation. On the other side sit the banks, whose public contribution so far consists of breach disclosures and blocked IP addresses. No institution has put a before-and-after measure of its detection speed, its access controls, or its internet-facing systems on the public record. As of today, the overhaul exists mainly as regulator-driven process, and customers are being asked to trust that process rather than observe its results.

How the attackers got in through the side doors

ARTEX is an agentic penetration-testing framework: software that hands a target to a large language model and lets the model loop through reconnaissance, vulnerability discovery, and exploitation with limited human supervision. It was released as open source on GitHub by a developer using the name "Autumn-27," reportedly after winning a challenge run by Baidu's Security Response Center, and it circulated mainly among Chinese-speaking users (6, 2). In this campaign, the attacker configured it with DeepSeek v4.1-flash as its primary model, supplemented by Zhipu AI's GLM-5.3 and Grok 4.6 (4, 6).

None of the successful attacks touched customer-facing internet or mobile banking. Every one entered through peripheral systems: a loan-agent inquiry service at Shinhan that brokers use to check application status, an employee mobile work-support platform at KB Kookmin, and a sales-support tool called ODS at Hana (1). The exploited flaws were ordinary ones, including SQL injection and authentication bypass, on portals that served loan brokers and employees rather than customers (6). A Korea Financial Security Institute official described the imbalance plainly: security on customer-facing electronic financial services "has been enormously strengthened, but internal employee-facing systems had been managed less rigorously" (1).

The record also captures how slow detection was, which matters because detection speed is one of the few things that can actually be measured later. Shinhan's intrusion began September 28. The anomaly was noticed the next morning, more than 15 hours in, and the connection was cut about 30 hours after first access. KB Kookmin needed roughly 43 hours to detect the compromise of its employee support system (2). Those are the "before" numbers. No bank has published an "after."

One correction to the early framing deserves a place here. The AI did not hack anyone on its own. "It is true that AI was used in the attacks, but the AI did not act independently without human involvement," the Financial Security Institute official said. "A hacker used the AI as a tool" (1). What the tool changed was the technical bar and the speed: it located long-neglected back doors faster than the banks that owned them (7), and it significantly lowered the barrier to conducting a complex intrusion (6).

Who was breached, and who repelled the same attack

The disclosed damage, institution by institution: Shinhan reported 25,729 people exposed through the loan-agent inquiry service, with names, phone numbers, annual income figures, and calculated loan limits among the fields taken, along with national ID numbers and online identity-verification identifiers (1, 2). KB Kookmin reported 119 records from its employee support system. Hana reported 89 records from ODS. BNK Busan reported personal details of 11 contract workers. Yegaram Savings Bank reported about 40,000 people's names, birth dates, and contact details. Welcom Savings Bank reported leaked corporate client data, with the total still being measured. Hyundai Capital reported 146 mortgage loan solicitors' names, contact details, email addresses, and national ID numbers (2).

Woori and NH NongHyup were targeted in the same window by the same attacker and sustained no breach, because the specific vulnerabilities the attacker sought were not present in their systems (1). Industry observers cited differences in basic security practices, including whether multi-factor authentication and access controls were in place and how much external support-system surface each institution exposed, as among the factors that determined who fell (7). That is interpretation rather than proof. But the pattern is consistent across the technical writeups of this campaign: the winning defense was not a smarter AI. It was hygiene that was already installed before the attack arrived.

The damage count grew as the investigation spread. It stood at just under 26,000 people on October 3, exceeded 65,000 by October 5, and reached about 68,000 in the government's October 6 accounting; Zscaler's independent analysis put the figure at roughly 67,000 individuals (1, 2, 3, 6). By mid-October, regulators counted 16 victimized financial companies and roughly 100,000 compromised records (7). No unauthorized transfers or account withdrawals had been confirmed as of October 5 (2).

What the evidence shows about who did it

The Korea Financial Security Institute confirmed ARTEX's role by tracing attack IP addresses and server logs at Shinhan, the first institution to report, and identified a data signature common to traffic generated by ARTEX (1). An HTML title on a suspected attacker-controlled server read "ARTEX-自主渗透测试控制台," which translates roughly to "autonomous penetration testing console" (2).

CrowdStrike's analysis goes further. Researchers found open directories on attacker infrastructure holding Claude Code session histories, ARTEX configuration files, and Claude memory files, revealing a two-server setup: a Hong Kong-based address as primary infrastructure and a second host running the ARTEX instance. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker motivated by money, and the campaign has not been attributed to any named group (4). The same session logs show the actor asking Claude where stolen Korean data is typically sold and how to find Korean Telegram groups for data sales, and in one session, generating a security-researcher résumé containing a name, phone number, Telegram handle, and a Maoming, Guangdong location. CrowdStrike notes those details likely belong to the actor but cannot be definitively tied to the person behind the attacks (4, 5).

Two further findings belong in the ledger of what is known. The attacker rotated IP addresses after each block, and investigators described blocking as "little more than emergency first aid" (1). And the Institute suspects that a previously reported hack of the Government24 portal was the work of a different attacker, based on timing (1).

Where this story sits

5 related pieces

Hover a story · click to read

1. No. 64 · Oct 11, 2026The ARTEX AI bank hack claim: what South Korea's record actually shows
2. No. 69 · Oct 14, 2026Could AI Power the Next Major Bank Cyberattack? Lessons From South Korea
3. No. 61 · Oct 7, 2026ARTEX AI Hit Seven South Korean Banks. Attribution Just Got Harder.
4. No. 52 · Sep 21, 2026The Sahel Juntas' Post-Wagner Arsenal: Drones, Air Defenses and What They Changed
5. No. 63 · Oct 7, 2026After the Indictment: Three Years of Named Cyber Attributions, Measured

The inspection that flagged 130 of 555 financial companies

The response with paper behind it is regulatory. Within days of the first breach reports, the government activated a round-the-clock cybersecurity emergency and held an emergency meeting on critical IT systems, and the National Police Agency's cyber-terror unit opened an investigation (2, 5, 3). The Financial Services Commission said it would recommend that institutions comprehensively audit internal employee-facing systems (1).

Then came the measurement. A review of 555 financial companies, completed in mid-October, found deficiencies at 130 of them. Inspectors recorded unapplied security patches, poorly managed aging systems, missing round-the-clock monitoring, absent authentication and authorization controls on external systems, and critical services running without multi-factor authentication (7). Authorities have committed to a sector-wide security review and to vulnerability assessments at large financial firms at least twice a year (7).

The crisis also forced disclosure of the sector's starting line. Data the Financial Supervisory Service submitted to the National Assembly's Political Affairs Committee, obtained by People Power Party lawmaker Seo Il-jun, shows that as of late September, 49 of the FSS's 2,236 staff, or 2.2 percent, held information-security certifications. At the five major banks, certified professionals ranged from 0.28 to 0.52 percent of total staff, 285 of 68,565 employees combined, and even within IT departments the rate ran between 4.55 and 7.14 percent. Certifications are an imperfect proxy for capability, but they are now a published number that future disclosures can be measured against (7).

One structural weakness surfaced during the investigation itself: financial institutions are not required to report attacks that cause no damage. The Institute said far more institutions were attacked than those that ended up with incidents, including organizations outside banking (1). Under that rule, a failed attack stays invisible unless the target goes looking.

What the banks have put on the record themselves

Here the documentation thins out. The bank-side actions that are documented are breach disclosures to regulators and the public, including Yegaram's own website notice; blocking the attacker's IP addresses; and sector-wide log reviews after the Financial Security Institute shared attacker IPs, which is how several banks discovered their own breaches days late (1, 2).

What is not in the public record, as of October 17, is any institution-specific account of what changed. No bank has published new controls it installed, a re-architected portal, a completed MFA rollout, or a detection-time comparison. No independent party has verified remediation at any of the seven. Whether the 130 flagged companies have fixed anything is unknown. Whether the twice-yearly assessment regime has started is unknown. Customer-facing remediation such as credit monitoring offers does not appear in the reporting reviewed here. Investigators said the attacker extracted data by querying it rather than taking systems over, expected direct financial harm to be low, and warned that the leaked records could be used for voice phishing and similar scams (1, 2).

For contrast, the technical playbook is not mysterious. Zscaler's analysis of this exact attack path recommends server-side authorization on partner and employee portals, alerts on sequential record lookups with rate limits on affected endpoints, treating open-source pentesting harnesses as hostile code, and repeated authorization testing as applications change (6). Nothing in the public record yet shows any of the seven implementing it.

There is also a jurisdictional point that shapes where documentation can exist at all. These institutions answer primarily to Korea's Financial Services Commission and Financial Supervisory Service, with the Korea Financial Security Institute running the technical investigation, not to US banking regulators. The paper trail runs through Korean regulatory actions, a police probe, and National Assembly disclosures. Nothing in the public record reviewed here connects the campaign to a CISA advisory, a US enforcement action, or filings with US market regulators.

Timing deserves a fair hearing, too. The campaign ended roughly two weeks ago. Institutions that respond well spend months re-architecting exposure, and that work does not publish itself overnight. The absence of documented fixes today is not evidence that no work is happening. It is evidence that, so far, the only entity holding a measuring tape is the regulator.

The tool came back before the fixes did

While the sector was being inspected, the offensive side moved the other way. After the attacks were publicly tied to ARTEX, its developer made the project closed source. Copies did not disappear: forks and English- and Korean-language derivatives remained available (6, 5). In mid-October, the Chinese security firm ThreatBook unveiled a cloud platform called RedAgents.AI hosting ARTEX Pro, the commercial successor, alongside other agents including YanJi, YanXun, and CyberStrikeAI. The tool returned as a commercial service within days of being pulled from public access (7).

"Shutting down ARTEX alone does not solve the problem," said Kwon Tae-kyung, a professor at Yonsei University's Graduate School of Information. "There are already many similar tools out there, and many people have downloaded the open-source version of ARTEX, so variants will keep appearing. If autonomous penetration tools become coupled with more advanced LLMs, we could see incidents far more serious than what we have now" (7).

Are customers measurably safer two weeks on?

Only partially, and an honest accounting separates three layers. The first is harm: no confirmed theft of funds as of the reporting reviewed here, because the attacker queried data out of systems rather than seizing them (2, 1). The second is process: the inspections, the audit recommendation, the assessment cadence, and the police investigation are real, documented, and unusually fast. The third is verified posture change at the seven institutions, and on that layer the public record is, for now, empty.

What would count as documentation is not hard to name. A published remediation count for the 130 flagged companies. Per-bank detection times from the next incident compared against the 30- and 43-hour figures this campaign produced. An independent assessment of employee-facing portal security. Any of the seven disclosing, in the annual reports that will eventually follow, what they rebuilt and what it cost.

Until then, the strongest evidence in the entire record that security posture decides outcomes is the pair of banks that did not fall. Woori and NH NongHyup faced the same attacker, the same tool, and the same week, and the doors the tool was probing for were not there (1, 7). That is what a defensible posture looked like before ARTEX arrived. The seven that were breached now have regulators measuring them. Customers will be safer when, and only when, the banks start publishing numbers of their own.

Sources / References

1. Jeong Ho-won, "Exclusive: Chinese AI tool ARTEX used in wave of bank hacks, probe finds," The Herald Business, October 3, 2026. https://biz.heraldcorp.com/article/10892497
2. Clayton Lewis, "Open-Source AI Agent Hacked Seven South Korean Banks, Exposing 65,000 Records," TechTimes, October 5, 2026. https://www.techtimes.com/articles/328541/20261005/open-source-ai-agent-hacked-seven-south-korean-banks-exposing-65000-records.htm
3. Sooyoung Rhee and Raffaele Huang, "Hackers Use Chinese AI Tool to Hit South Korean Banks, Exposing New Risk," The Wall Street Journal, October 6, 2026. https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885
4. CrowdStrike Intelligence, "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance," October 7, 2026. https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
5. Bill Toulas, "Hacker used ARTEX AI and Claude agents to target South Korean banks," BleepingComputer, October 10, 2026. https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
6. Rohit Hegde and Jithin Prajeev Nair, "Threat Actors Abuse AI Pentesting Framework," Zscaler ThreatLabz, October 14, 2026. https://www.zscaler.com/blogs/security-research/threat-actor-abuses-agentic-ai-pentesting-framework-target-south-korean
7. Park Hye-rim and Seo Sang-hyuk, "AI hacking tool ARTEX returns as commercial product, raising alarms in financial sector," The Herald Business, October 17, 2026. https://biz.heraldcorp.com/article/10905545