South Korean police have identified seven suspects linked to a cybercrime operation that compromised more than 90 organisations and allegedly stole 8.2 million data records.
Investigators said the group’s 32-year-old leader, a former penetration tester, used the ARTEX AI hacking framework to expand attacks against hospitals, educational institutions and major corporations.
How Did the Cybercrime Operation Begin?
According to Seoul Metropolitan Police, the suspected ringleader was a self-taught hacker who worked at a cybersecurity company between 2019 and 2022. He allegedly began targeting organisations in September 2025, initially relying on conventional hacking tools.
Investigators said he adopted AI-powered utilities in late August 2026 to expand the operation, using ARTEX AI, an autonomous penetration-testing framework, in most attacks.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Was ARTEX AI Used?
Police identified ARTEX AI as a central tool in the attacks. The same framework had previously been associated with cyberattacks targeting multiple South Korean banks attributed to a Chinese-speaking threat actor.
The suspect’s adoption of AI tools marked a change from conventional hacking methods to more automated techniques. Authorities said AI technologies were increasingly enabling individuals to conduct sophisticated attacks previously associated with highly skilled cybercriminals.
What Data Was Stolen?
Investigators believe approximately 8.2 million records were stolen from more than 90 compromised organisations. The affected entities included educational institutions, hospitals, large corporations and golf courses.
In 38 incidents, the attacker allegedly demanded ransom payments totalling 360 million South Korean won ($270,000), promising not to disclose the stolen information.
How Did Police Identify the Suspects?
The investigation began after a victim submitted a complaint in June. Investigators examined server logs recovered from compromised organisations and traced evidence connecting the suspects to the attacks.
Authorities also reportedly used an internally developed AI tool to analyse recovered digital evidence. All seven suspects were arrested, although only the alleged ringleader remains in custody.
What Is the Status of the Investigation?
The suspected leader was arrested on October 15, formally detained on October 17 and referred to prosecutors on October 23.
The remaining six suspects continue to face investigation without detention. Police are examining whether any stolen information has subsequently appeared on dark web platforms.
What Does This Mean?
The investigation highlights growing concerns about AI-assisted cybercrime and the potential for automated tools to expand the scale of attacks.
South Korean police described the case as the country’s first arrest involving large-scale hacking and personal information theft using generative AI.
The findings underline how legitimate penetration-testing technologies can be misused for unauthorised access, data theft and extortion.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
