Korea’s banks guarded the front door well. The attackers, with an open-source AI tool doing the legwork, went round to the side.

Over the past week a wave of breaches hit South Korea’s financial sector. The Korea Herald reports that by 4 October seven institutions had reported breaches (Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital), with reports putting combined exposure at about 66,000 individuals and 2,200 corporate records. Woori and NH NongHyup were reportedly targeted without confirmed leaks. A Korea Financial Security Institute official told The Herald Business that tracing attack IPs and server logs from Shinhan Bank turned up evidence of ARTEX, an open-source, LLM-based autonomous penetration-testing system distributed mainly on GitHub. The official was precise: AI was used, but it “did not act independently without human involvement”; a hacker used it as a tool. Every attack hit internal employee- or partner-facing systems: a loan-agent inquiry service at Shinhan (25,729 people), an employee mobile work-support system at KB Kookmin (119 records), and an employee sales-support system at Hana (89).

Three things should change how security leaders think about this. First, speed: The Kyunghyang Shinmun reports that ARTEX appeared on GitHub on 26 July, its latest version shipped on 24 September, and the attack on Kookmin began three days later. Second, the target choice: regulators said the exploited weaknesses were concentrated in authentication and access control on externally reachable business-support systems. One Yonsei University professor summed it up: “the front door was well-guarded but the side door was left open.” A tool that tries everything finds whichever system your org chart forgot was a door. Third, blocking does not stick. The institute says the attacker switches IPs whenever one is blocked, calling IP blocking “little more than emergency first aid”, while the method and the targeted vulnerabilities stay the same. The response has been national: the Financial Supervisory Service shared 28 attack-linked IP addresses, police assigned 28 cyberterrorism investigators, and President Lee Jae Myung called for an overhaul of “our society’s security paradigm for the AI era.”

What security leaders should do:

• Inventory every partner-, broker- and staff-facing app reachable from outside, and give it the same multi-factor authentication, session controls and least privilege as your customer channels.
• Detect behaviour, not addresses: alert on bursts of record lookups and enumeration patterns, because attack IPs rotate faster than blocklists.
• Assume a public offensive AI tool is weaponised within days of release, and run authorised testing against your own external surface first.
• Warn customers early: names, incomes and loan limits are exactly what a convincing voice-phishing call needs.

AI did not make this attacker sophisticated. It made them fast, and fast finds the door you forgot was a door.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #ThreatIntel #APAC #FinancialServices #CyberSecurity

Sources: The Herald Business (Korea Financial Security Institute) · The Herald Business (FSC) · The Korea Herald · The Kyunghyang Shinmun