An ex-pentester, an AI toolkit, over 90 breaches

South Korean police have identified seven suspects linked to an operation that breached more than 90 organisations in the country, with the ARTEX AI penetration-testing framework used in most of the attacks. According to local media citing the Seoul Metropolitan Police, the leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022.

Authorities believe 8.2 million records were stolen from educational institutes, hospitals, large corporations and golf courses. In 38 of the incidents the attacker demanded 360 million won, about 270,000 dollars, in exchange for not leaking the data. Yonhap reports that the leader is a self-taught 32-year-old who began attacking organisations in September 2025, used conventional tools at first, and adopted AI utilities in late August 2026 to expand the attacks. Police said ARTEX AI is the same autonomous framework used in attacks on several South Korean banks attributed to a Chinese-speaking threat actor.

All seven were arrested, but only the leader remains in custody. He was arrested on 15 October, formally detained two days later and referred to prosecutors on 23 October; the other six remain under investigation without detention. The case began with a victim's complaint in June, and investigators traced the suspects through server logs from the breached organisations, which the police say they analysed with an in-house AI tool.

The police presented the case as both a first and a warning. They told Yonhap it was the first arrest in Korea for a large-scale hacking and personal-data theft crime that exploited generative AI, and the investigation now turns to whether any of the stolen data has surfaced on the dark web.

Even individuals who are not professional hacker organizations can now hack on a large scale with the help of AI.