South Korean police have identified seven suspects in a cybercrime operation that allegedly breached more than 90 organizations and stole 8.2 million records. The attacks targeted educational institutions, hospitals, major corporations and golf courses, with most of the activity reportedly conducted using the ARTEX AI penetration-testing framework. In 38 cases, the attackers demanded 360 million won (about $270,000) to prevent the release of stolen data.
Former penetration tester allegedly led hacking operation
According to local media reports citing the Seoul Metropolitan Police, the alleged gang leader previously worked for a cybersecurity company as a penetration tester from 2019 to 2022. Police described him as a self-taught hacker who began targeting organizations in September 2025.
Yonhap News reported that investigators believe the group initially relied on traditional hacking tools before adopting AI utilities in late August 2026 to expand and accelerate its attacks.
Seoul Metropolitan Police told the publication that the suspects used the ARTEX AI penetration-testing suite. The same autonomous framework has been linked to attacks against several South Korean banks attributed to Chinese-speaking attackers.
Ransom demands followed data theft
The stolen information came from more than 90 compromised organizations, including schools and other educational institutions, hospitals, large companies and golf courses. Police believe the attackers obtained approximately 8.2 million records in total.
In 38 incidents, the group allegedly demanded a ransom of 360 million won, or approximately $270,000, in return for a promise not to disclose the stolen data.
Source: Yonhap News
Police arrest alleged leader
Authorities arrested all seven suspects, although only the alleged leader remains in custody. Police arrested him on October 15, formally detained him two days later and transferred him to the prosecutor’s office on October 23. The other six suspects remain under investigation but are not in custody.
Police opened the case in June after one victim filed a complaint. Investigators reportedly traced the suspect through server logs from the compromised organization. Law enforcement officials also used internally developed AI tools to analyze evidence recovered during the investigation.
Police warn AI is lowering the barrier to cybercrime
South Korean police have told local media that AI tools are reducing the technical expertise needed to conduct cyberattacks. They said this is contributing to large-scale, high-impact incidents that previously would have required advanced skills.
Police told Yonhap News Agency: “This is the first time that a suspect in connection with large-scale hacking and identity theft crimes that exploited generative AI has been arrested in South Korea.”
They added: “Individuals who are not part of professional hacker organizations can now perform large-scale hacks with the help of AI.”
Investigators are continuing to examine the case, including whether the stolen information was published on the dark web.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com