Story perspectives

South Korea probes AI-linked bank cyberattacks after leaks

By Drooid · Oct 6, 2026, 11:15 AM UTC · How we work

Summary

President Orders Bank Probe

President Lee Jae Myung said AI enabled hacks, ordered an investigation and told the cabinet to clarify circumstances.
Office of Investigation opened a probe into cyberattacks on Hana, KB Kookmin and Shinhan banks.
Leaks exposed 25,000 people at Shinhan, 89 customers at Hana and 99 customers and 20 employees at KB Kookmin.
Chairman Lee Eog-weon held an Oct 4 meeting and shared data on 28 IP addresses linked to the attacks.

Summary

Investigators Trace AI Breach

Investigators traced the breach to ARTEX AI, an open-source autonomous penetration-testing framework hosted on GitHub.
The tool’s HTML title read “AI autonomous penetration testing console,” suggesting it uses a large-language-model system.
Global significant attack traffic originated from IP addresses in the United States, Japan, Singapore, Vietnam and Britain, complicating attribution.

History

Historical Context

In May 2017 the WannaCry ransomware worm used the NSA-leaked EternalBlue exploit to encrypt roughly 230,000 Windows computers across more than 150 countries, a spread halted by Marcus Hutchins’s kill-switch registration. The attack’s impact spurred regulators, including South Korea’s Financial Services Commission, to demand coordinated AI oversight as banks such as Shinhan, Hana and KB Kookmin confront AI-enabled breaches built on the same open-source framework.

1 of 3

President Orders Bank Probe

President Lee Jae Myung said AI enabled hacks, ordered an investigation and told the cabinet to clarify circumstances.
Office of Investigation opened a probe into cyberattacks on Hana, KB Kookmin and Shinhan banks.
Leaks exposed 25,000 people at Shinhan, 89 customers at Hana and 99 customers and 20 employees at KB Kookmin.
Chairman Lee Eog-weon held an Oct 4 meeting and shared data on 28 IP addresses linked to the attacks.

1 / 3