ARTEX's developer made the open-source agent closed-source on October 8 after CrowdStrike linked it to a China-based 26-year-old who breached South Korean banks. The campaign exposed roughly 68,000 customer records, Cryptobriefing reported.
Perspective Coverage
5 publishers
- Builder
- Builder 34%
- Operator
- Operator 51%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+30
- Incentives40
- Confidence62
President Lee Jae Myung says AI appears to have been used in hacks on South Korean banks that leaked data on at least 25,000 Shinhan customers. If his claim that AI removes the need for specialized skills holds up, banks should plan for many more attackers.
Perspective Coverage
18 publishers
- Builder
- Builder 32%
- Operator
- Operator 52%
- Investor
- Investor 16%
Reality
- Evidence70
- Adoption35
- Hype gap+20
- Incentives55
- Confidence64
South Korea's police added 15 specialists to the team investigating hacks of financial institutions, taking it from 28 to 43 investigators. Because the trail leads to attack servers abroad and the case could be handed to another agency, part of the probe's timing depends on people outside the police.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 52%
- Investor
- Investor 23%
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives60
- Confidence64
A single actor used a free Chinese pentest agent and four commercial AI models to breach South Korean financial firms in about two weeks. The free, resold toolkit let one person breach several firms at once, and researchers expect adversaries to keep using it to lift their tempo.
Reality
- Evidence45
- Adoption15
- Hype gap+15
- Incentives
- Insufficient
- Confidence40
CrowdStrike tied AI-assisted South Korean bank attacks, run on an open-source pentest tool and DeepSeek, to a possible 26-year-old suspect in Guangdong. The reported breaches involved systems banks run for brokers and staff, so the exposure to manage sits at the bank's edge, whoever the attacker proves to be.
Perspective Coverage
6 publishers
- Builder
- Builder 31%
- Operator
- Operator 52%
- Investor
- Investor 17%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence65
South Korea's FSC paused a plan to open bank network-separation exemptions to 75 firms after ARTEX-assisted hacks breached seven financial firms. The pause holds back at most 15 exemptions while regulators work out whether the attacker got in through the rule they were loosening or around it.
Perspective Coverage
8 publishers
- Builder
- Builder 38%
- Operator
- Operator 41%
- Investor
- Investor 21%
Reality
- Evidence62
- Adoption35
- Hype gap+30
- Incentives45
- Confidence60
President Lee Jae Myung ordered resources onto a breach of customer data at seven Korean financial firms, citing possible AI use in some attacks. What the firms pay will turn on a network law amended five days earlier and on which ministry runs the case.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+25
- Incentives55
- Confidence55
Shinhan Bank exposed data on about 25,000 customers through a loan-broker inquiry platform kept apart from its core banking systems. Yonhap reports AI may have automated the credential stuffing, so the side systems that touch customer data are where lenders' security spending now gets tested.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 49%
- Investor
- Investor 27%
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+25
- Incentives50
- Confidence60
Korea's National Police Agency booked the AI-driven attack on Shinhan Bank as a criminal case and assigned 28 cyberterrorism investigators to it. Whether the case moves to the new Serious Crimes Investigation Agency turns on how the Financial Services Commission classifies the bank's system.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence55
Korea's Financial Services Commission is due on the 7th to name about 15 more financial firms exempt from network separation rules, after a first round of 10. Network separation rules are what stop lenders running AI security tools, so the list decides who can use AI against AI-driven hacking.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence50
Korean regulators sent security orders to about 500 financial firms after the same attacker IP turned up in breaches at seven lenders. Almost every firm doing the emergency reviews has no reported breach, so the cost is shared across the sector.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence58
Korea's Financial Services Commission ordered a sector-wide security review after suspected AI-agent hackers hit the country's five largest banks. The three biggest leaks ran through employee, sales and broker tools, so the review's cost lands on systems customers never see.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+25
- Incentives45
- Confidence55
FSC chairman Lee Eok-won told Korean financial firms they will be held strictly accountable under law if the hacks that hit six lenders happen again. The threat covers future breaches, so for the firms already hit the cost so far is five requests, including security checks and customer compensation.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence55
South Korea's Financial Services Commission will block outside access to staff and loan-broker web pages by default after leaks at six firms. Every page a firm keeps reachable now has to be justified as indispensable to services or work.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Korea's community credit cooperative federation blocked access from the IP address behind the Shinhan Bank leak as attacks reached a fourth financial sector. The main way in so far has been services built for loan brokers and employees, set apart from the systems that process transactions.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence45
South Korea's People Power Party wants intelligence agencies in a joint probe of hacks it says have hit six lenders, four of them commercial banks. Its spokesperson concedes the attacker is unknown, so whether the six share one cause will decide who answers for them.
Reality
- Evidence25
- Adoption
- Insufficient
- Hype gap+40
- Incentives75
- Confidence30
South Korea's Financial Services Commission ordered banks and card firms to check every externally reachable IT system after data leaks at four banks. The regulator will collect the returns and use them to build new cybersecurity measures for the financial sector.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence62
Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+20
- Incentives45
- Confidence55
The bank says its own systems are clean and points at a contractor of a contractor it will not name. That is precisely where most vendor-risk programs stop looking.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives60
- Confidence50
At Tuesday's House Financial Services hearing the Treasury Secretary called a liability waiver a "blank check" and said the labs want one while also asking the industry to slow down. He urged both houses to refuse.
Reality
- Evidence64
- Adoption34
- Hype gap+26
- Incentives66
- Confidence57