AI Tool Raises Alarm After Cyberattacks Hit Major Korean Banks

A series of cyberattacks on major Korean banks has raised fresh concern about the use of artificial intelligence to automate hacking, after investigators reportedly found traces of an autonomous penetration-testing tool known as ARTEX.

The incidents have affected several financial institutions since last week. Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank and BNK Busan Bank reported data breaches, while Woori Bank and NH NongHyup Bank detected attempted intrusions but said they had not confirmed information leaks.

Shinhan reported the largest known impact, saying information belonging to about 25,000 customers was exposed. The affected data included names, phone numbers, annual income and loan limits. KB Kookmin said 119 customers were affected, and Hana reported exposure involving 89 customers.

ARTEX is described as a Chinese-language autonomous penetration-testing tool capable of performing work that would traditionally require substantial human expertise. Such systems can scan networks for weaknesses and develop potential attack paths, allowing an attacker to probe multiple targets faster than through a largely manual process.

Security specialists cautioned, however, that the language or origin of a tool does not establish who conducted an attack. The actor behind the Korean bank incidents has not been identified, and downloadable AI systems can be obtained and modified by users in different countries.

Experts also said the relatively limited number of confirmed victims at most banks should not be interpreted as proof that the threat has passed. Initial findings suggest attackers may have entered through supporting networks rather than the banks’ more heavily protected core systems. Those auxiliary networks can offer an indirect route to sensitive information when their defenses are weaker.

The incidents illustrate how AI could change both the speed and scale of cybercrime. A conventional attacker must identify targets, test defenses, locate vulnerabilities and determine how to exploit them. An AI agent can automate portions of that sequence and examine possible routes in parallel, reducing the time and labor required.

That capability is prompting calls for financial companies to strengthen monitoring beyond their central banking systems and apply equally rigorous controls to connected support infrastructure. Specialists also argue that defenders will need to deploy AI-based tools of their own to identify vulnerabilities earlier and maintain continuous automated responses.

The breaches remain under investigation, and there is no confirmed evidence that a larger follow-up attack is planned. Still, the discovery of an automated tool in a cluster of incidents across the financial sector has made the attacks an important test of whether Korea’s cybersecurity safeguards can adapt as offensive AI capabilities become more accessible.