The crew behind this month's AI-assisted break-ins at South Korean banks was building and testing its toolkit weeks before anyone noticed, and it left much of that work sitting in open directories on its own servers.
New research from Recorded Future's Insikt Group tracks the actor as TAG-217 and pushes its known timeline back to mid-August 2026. Insikt also found tooling for cryptocurrency theft, Linux system abuse and mobile exploitation that goes beyond the banking campaign, which public reporting says exposed personal data belonging to at least 68,000 people across at least seven financial institutions.
A breach wave already tied to an AI pentest tool
In early October, South Korea's Financial Services Commission disclosed that multiple financial institutions had been hit, with different systems and data affected at each. One breach exposed the personal information of an outsourced developer; another led to the theft of customer data. Industry sources linked the attacks to ARTEX, a Chinese-language, open-source AI penetration testing framework, as we reported at the time. Insikt says public analysis on October 7 identified the operator, suspected to be a Chinese speaker, using several AI tools including Claude Code, DeepSeek, Grok and Zhipu AI, and routing traffic through residential proxies.
What the open directories gave away
Working from infrastructure named in that earlier reporting, Insikt reconstructed this sequence:
- August 17 to 22: testing of remote-access infrastructure and internet scanning. Logs showed repeated test connections between the actor's own servers, not successful access to victims.
- By August 22: tools aimed at cryptocurrency mining operations running the YiiMP platform, able to try default passwords, steal wallet configuration and key files, keep remote access and send Telegram alerts when credentials were captured. Other tools targeted known Linux weaknesses to gain more control or extract protected password data after access.
- By September 5: a workspace for testing iPhone weaknesses and modifying Android system software. Insikt saw experimentation, but no evidence of a successful compromise.
- By September 26: AI tools and records referencing reconnaissance, traffic proxying, payload delivery and the examination of payment processes, plus tooling to route traffic through residential connections and copy AI working-memory files between the actor's servers.
Insikt calls this the "jagged edge" of AI-enabled attacks. The tools let one opportunistic operator probe many targets across many environments, yet did nothing to prevent basic operational security mistakes that an experienced crew would likely have caught. The firm is careful on one point: the evidence does not establish how much AI actually accelerated the attacks, only how widely the actor ranged and that it used AI services, likely in pursuit of financial gain.
Fix the exposure AI will find faster
Insikt assesses it is highly likely that more threat actors will fold ARTEX and similar tools into their operations. Its advice is mostly about old weaknesses becoming cheaper to find. Inventory every internet-facing service, including employee and partner applications. Verify that users can reach only the records they are authorized to see. Log and monitor those services, and correlate attacker infrastructure with internal signals such as unusual sign-ins, repeated requests for different customers' records, unexpected remote access and abnormal data transfers. Insikt also recommends pre-authorized, proportionate automated responses for well-understood threats, with extra review where an address may belong to a shared proxy service.
Recorded Future has not published TAG-217's indicators publicly; they are available to its customers. For defenders at South Korean institutions and elsewhere, the lesson is that AI-assisted intrusions can be fast and broad while still being noisy, and that noise is exactly what let Insikt map this one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.