· ai-devtools
ARTEX AI used in cybercrime, suspects linked to 8.2 million record theft
A 32-year-old self-taught hacker initiated attacks against various organizations starting in September 2025.
South Korean police have identified seven individuals connected to a cybercrime operation that compromised over 90 entities across the nation. This operation heavily utilized the ARTEX AI pentesting framework during most of its intrusions.
The gang's leader, who possesses a background in penetration testing, previously worked at a cybersecurity firm from 2019 to 2022. Authorities estimate that the threat actor successfully stole 8.2 million data records from targets including hospitals, educational institutions, large corporations, and golf courses.
In 38 separate incidents, the perpetrator demanded ransom payments totaling 360 million won ($270,000), offering to withhold the stolen data if the payment was made.
The Seoul Metropolitan Police reported that the hacker initially employed standard tools but began incorporating AI utilities in late August 2026 to amplify the scope of the attacks. This suite, ARTEX AI, is the same autonomous framework seen in attacks against several South Korean banks linked to a Chinese-speaking actor.
Law enforcement arrested all seven suspects; however, only the leader is currently detained. He was apprehended on October 15 and formally held two days later, being referred to prosecutors on October 23.
Police stated that AI has lowered the entry barrier for aspiring cybercriminals, enabling large-scale, high-impact incidents that previously required highly skilled actors. Yonhap reported the police noted, “This is the first case of arrest of a suspect in Korea related to a large-scale hacking and personal information theft crime that exploited generative AI.”
The investigation, which began after a victim lodged a complaint in June, involved tracing suspects through server logs from the breached organizations, utilizing an in-house AI tool to analyze recovered evidence.
