Suspect in AI-assisted hacks on Korean financial firms linked to Chinese DDoS-for-hire groups; ARTEX tool's public development halted (report)

What happened

According to the Electronic Times (etnews), security firm Logpresso said in a recent report that an account belonging to the suspect in a string of hacks on South Korean financial firms appears to have been active in GodNet and VITAS, Chinese DDoS-for-hire groups. Police have added more investigators to the case. Industry sources said public development has stopped on ARTEX, the Chinese-made AI penetration testing tool used in the attacks.

Provider claims

The suspect's link to Chinese groups is Logpresso's analysis in its report, not a conclusion confirmed by investigators.

Why it matters

The case had been discussed as possibly the work of a single person; there are now signs that organized groups were involved. Development of an open-source AI penetration tool stopped after it was used in real attacks, which could lead to debate over how AI tools that can be repurposed for attacks should be released and managed.

Sources

• Press 금융권 AI 해킹, 中 조직 연루 정황…아르텍스는 개발 중단 Electronic Times (Korea)

Story thread

1. 2026-10-07 'AI hacking' hits Korean financial firms: Yegaram and Welcome Savings Bank customer data leaked; no further damage confirmed at other members (report)
2. 2026-10-08 Suspect in serial hacks on Korean financial firms believed to be 26-year-old in Guangdong, China; AI usage records offer identity clues (report)
3. 2026-10-08 CrowdStrike says Korean financial-sector hack may be one person's work using open-source AI tool 'ARTEX' and several LLMs (community report)
4. 2026-10-11 Suspect in AI-assisted hacks on Korean financial firms linked to Chinese DDoS-for-hire groups; ARTEX tool's public development halted (report)