South Korean financial organizations

Shinhan, KB, and Hana Bank hacked, and even second-tier lenders such as Yegaram Savings Bank and Hyundai Capital

Randomized attacks using an AI released in July targeted internal systems with weak security

IPs from eight countries, including Korea, the United States, and Japan, were used; identifying the attackers may take time

Commercial bank chiefs ‘urgently convened’ during the holiday As AI-driven hacking attacks spread across the entire financial sector, the financial authorities held an emergency inspection meeting on the 4th, a holiday, at the Government Complex Seoul in Jongno-gu, Seoul. Financial Supervisory Service Governor Lee Chan-jin heads to his seat past Hana Bank CEO Lee Ho-seong, KB Kookmin Bank CEO Lee Hwan-ju, and Shinhan Bank CEO Jung Sang-hyuk (from left), who were summoned to the meeting.

Not only commercial banks but also savings banks and capital companies suffered automated AI-based hacking attacks believed to be the work of the same actor, with tens of thousands of items of personal information siphoned off, putting the entire financial sector on high alert. The attack is said to have used a Chinese-language AI penetration-testing tool that has been public for just over two months.

According to the financial authorities and the industry on the 4th, between the 27th and 30th of last month, information was leaked due to external intrusions at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, and Hyundai Capital. It was also identified that more than 2,200 pieces of corporate customer information at Welcome Savings Bank were leaked that day due to a hacking attack. Two online investment-linked finance companies (P2P lenders) also suffered data leaks. Analysts say the number of financial companies that faced attempted attacks may be far larger.

At Shinhan Bank, 25,727 items of personal information were taken, including not only names and details but also annual income and loan limits. At Kookmin Bank and Hana Bank, information on 119 and 89 customers, respectively, was leaked.

On-site inspections by the Financial Supervisory Service and the Financial Security Institute are under way at Shinhan Bank. A Shinhan Bank official said that day, “We have been under inspection since the day of the report, and a task force has been formed, with employees coming in throughout the weekend.” Compensation plans and additional measures will be announced after consultation with the authorities.

The hackers targeted relatively less secure internal systems rather than customer internet and mobile banking. At Shinhan Bank, a loan-progress inquiry service used by loan brokers was breached; at Kookmin Bank, an internal mobile work-support system for employees was compromised. Park Chan-am, CEO of cybersecurity company Stealien, said, “The main systems in finance were fine because there are authentication mechanisms beyond IDs and passwords, but this time, because they were peripheral systems, that kind of attack appears to have been possible.”

The attack is presumed to have used an AI-automated brute-force approach. The attackers reportedly input random values into the service for loan brokers at Shinhan Bank to identify valid customer numbers and then extracted other information such as details. The authorities see this as AI randomly attacking multiple financial firms, with those having weaker defenses being breached, rather than a targeted strike on specific companies.

Financial Services Commission ‘Emergency inspection meeting across the financial sector’ President Lee also “Thorough investigation of this grave matter”

Traces indicate that a tool called ‘ARTEX’, believed to have been developed in China, was used. Moon Jong-hyun, head of the Genians Security Center, wrote on his social media on the 2nd, “In connection with attacks carried out against multiple domestic targets, in part of the HTML title of the web servers used in the attacks we confirmed the string ‘ARTEX-自主渗透試控制台(autonomous penetration test console)’.” ARTEX is an autonomous penetration-testing system based on a large language model (LLM) that has been released on the development platform GitHub. It was originally created as a kind of red-team tool for security assessments, automating mock hacking to find holes in systems before the hackers do.

According to GitHub records, ARTEX was released on July 26. On the 3rd of last month, it took overall first place among 150 teams at a cyber offense-defense competition hosted by Baidu in China. The latest version was released on September 24, and three days later, on the 27th, the attack on Kookmin Bank began. The developer is known only by the GitHub ID ‘Autumn-27’.

The perpetrator is presumed to be the same individual or group. Park Sang-won, president of the Financial Security Institute, told reporters that day, “The attack IPs are almost the same for the banks, and a bit different for the savings banks.” The fact that an AI tool developed in China was used does not, by itself, determine the nationality of the attacker. Park said, “ARTEX is open-source and publicly available worldwide,” adding, “Attack IPs can be routed through various places, so the IPs alone cannot identify the attacker.” IPs from eight countries, including Korea, the United States, Japan, and Hong Kong, were reportedly used in this attack. Park Chun-sik, a professor in the Department of Cybersecurity at Ajou University, said, “The more sophisticated the hacking group, the more they hide their tracks by transiting multiple countries.”

The financial authorities are concerned secondary damage from the leak. When names and details are combined with annual income and loan limits, the data can be abused for sophisticated phishing that approaches victims as if it were a real loan consultation. The Financial Services Commission held an ‘emergency inspection meeting across the entire financial sector’ at the Government Complex Seoul that day, chaired by Chairman Lee Ok-won.

President Lee Jae Myung also called for a thorough investigation that day.