A Chinese-developed AI penetration-testing platform, ARTEX AI, has been confirmed as the tool used in a series of data breaches at major South Korean banks. The Korea Financial Security Institute traced attack IPs and server logs from Shinhan Bank, identifying ARTEX as the tool involved.
The confirmed number of affected individuals stands at 25,729, although this figure may increase as investigations continue.
The attacks, occurring between late September and early October 2026, targeted internal employee or partner-facing systems rather than customer-facing services. The Korea Financial Security Institute confirmed that the AI did not operate independently, requiring human involvement.
An unidentified hacker, suspected to be a Chinese speaker, used ARTEX to breach multiple Korean financial institutions. The attacker primarily used DeepSeek v4.1-flash, supplemented by GLM-5.3 and Grok 4.6 through Claude Code sessions.
The Korea Financial Security Institute is drafting recommendations for financial firms to audit their internal systems. The breaches were concentrated between Sunday and Thursday, and multiple IPs were used, with two to three overlapping at each bank.