Hackers used AI chatbots and open tools to target South Korean banks

A hacker group tied to attacks on South Korean banks used several AI services, including Claude Code, DeepSeek, Grok and Zhipu AI, alongside an open-source hacking framework. Researchers could follow its work because the attacker left files and logs open on its own servers. Public reporting says personal data of at least 68,000 people was exposed across at least seven financial institutions.

What happened

Recorded Future's Insikt Group published its report on October 16. It tracks the actor as TAG-217 and says preparations began in August, weeks before the bank attacks became public. The open-source tool, ARTEX, is a Chinese-language framework for automated security testing. The wider investigation followed disclosures involving different services and types of data. It was not one shared weakness hitting every bank.

What the researchers found

The exposed records show an operator building a wide toolkit over several weeks. The attacker also used residential proxies, which route traffic through ordinary home internet connections, likely to hide where it came from.

• Aug 17 to 22: tested remote-access servers and scanned internet-facing systems.
• By Aug 22: built tools aimed at cryptocurrency mining operations running YiiMP, including wallet file theft.
• By Sept 5: set up a workspace for testing iPhone weaknesses and changing Android system software.
• By Sept 26: held AI tools and records covering scouting, proxy traffic and checks involving payment processes.

What is not proven

Finding a tool does not mean it was used. The logs did not show successful access to victims in the early tests. The mobile files showed experiments, not proven phone infections. A wallet-stealing script does not prove a bank lost cryptocurrency. Recorded Future also said the evidence cannot show that AI acted on its own, or measure how much AI sped up the attacks. It describes the actor as a suspected Chinese speaker, not a confirmed state-backed group.

What to do

The main lesson is that familiar defenses still matter. Recorded Future's advice for financial institutions applies to any business that holds customer data.

• List every service your business exposes to the internet.
• Check who has access, including employees and partners.
• Fix weaknesses first where the most sensitive data sits.
• Watch for odd sign-ins, unexpected remote access and unusual transfers.

Researchers also point to repeated requests for different customers' records as a warning sign. These signals can reveal an attack even when the attacker keeps changing its internet addresses.