Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ South Korean Organizations

Cybercrime Operation Uncovered

South Korean police identified and arrested seven suspects involved in a cybercrime operation that compromised more than 90 organizations across the country. The group stole approximately 8.2 million data records from various entities, including educational institutions, hospitals, large corporations, and golf courses. In 38 incidents, the threat actor demanded ransom payments totaling 360 million won ($270,000) to prevent data leaks.

ARTEX AI Framework Utilized

The gang leader, a 32-year-old self-taught hacker with a background in penetration testing, used the ARTEX AI pentesting framework in most of the attacks. Initially, the hacker employed conventional tools but adopted AI utilities in late August 2026 to expand the scope of the attacks. This is the same autonomous framework previously linked to attacks against South Korean banks attributed to a Chinese-speaking threat actor.

Arrests and Ongoing Investigation

Authorities arrested all seven suspects, with the group's leader remaining in custody after being formally detained on October 17 and referred to prosecutors on October 23. The other six suspects are under investigation without detention. Police initiated the investigation after a victim filed a complaint in June and traced the suspects through server logs, reportedly using an in-house AI tool to analyze evidence.

Impact of AI on Cybercrime

The Seoul Metropolitan Police stated that this is the first arrest in Korea related to a large-scale hacking and personal information theft crime exploiting generative AI. Police noted that AI has lowered the barrier to entry for aspiring cybercriminals, enabling individuals to execute large-scale, high-impact incidents that previously required highly skilled actors. The investigation continues, focusing on whether any stolen data has been leaked on the dark web.