Chinese DDoS-for-Hire Network Linked to AI-Powered Attacks on Korean Banks

A Seoul cybersecurity company has found online links between accounts associated with recent attacks on South Korean financial institutions and a Chinese distributed denial-of-service network, offering new clues about a campaign that reportedly combined several artificial intelligence tools.

Logpresso said an account using the name YY520CN was listed in September 2024 as a moderator of GodNet, an online community created by Vitas, a Chinese group that carries out denial-of-service attacks for paying clients. Such attacks overwhelm websites or online services with traffic, making them unavailable to legitimate users.

The security firm’s findings build on analysis published earlier this month by US cybersecurity company CrowdStrike. That investigation compared Telegram and GitHub records with credentials harvested by information-stealing malware. CrowdStrike disclosed the YY520CN username after examining records of AI use on a server connected to the attacks. The account was deleted on October 8.

A new account later appeared with the same username and a linked channel denying involvement. It is not clear whether the original operator controls the replacement account. The owner of a phone number associated with YY520CN also denied involvement and said the number had been used without permission.

Logpresso separately examined GitHub code linked to another person listed as GodNet staff. The code connected a Telegram account with a GodNet domain, while its editing history exposed an email address. Investigators then matched that address to login details stolen by infostealer malware in 2023. The compromised records included credentials for Microsoft and Oracle cloud services, suggesting the person may have helped operate technical infrastructure.

The second account has not been directly linked to the Korean bank attacks. Logpresso said subscriber records held by cloud providers could help investigators identify its operator and potentially trace the person behind YY520CN. The company stressed that the account connections alone do not prove who conducted the attacks or establish that a single person was responsible.

South Korean investigators suspect the attacker used multiple AI models, including DeepSeek, together with ARTEX, a Chinese-made AI penetration-testing tool. The campaign reportedly relied on control servers in Hong Kong, separate attack servers and alternative access routes while targeting seven Korean financial institutions in succession.

ARTEX’s developer has since said public distribution and updates will stop because the tool was misused in cyberattacks. The project is expected to move to a closed-source model, underscoring the challenge facing security researchers and developers when legitimate testing tools are repurposed for attacks.