Skip to content
AI-Assisted Cyberattacks Target 16 South Korean Financial Institutions

AI-Assisted Cyberattacks Target 16 South Korean Financial Institutions

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:49 UTC
  • •16 financial institutions in South Korea were targeted, leaking around 100,000 records.
  • •The threat actor TAG-217 utilized the ARTEX framework and various AI tools for the attacks.
  • •Experts warn that traditional defenses may be inadequate against evolving AI-assisted cyber threats.

A series of AI-assisted cyberattacks have compromised 16 financial institutions in South Korea, leaking approximately 100,000 personal records. The attacks, involving the ARTEX framework, have affected banks, virtual asset companies, and electronic financial firms, with breaches exposing sensitive information such as names and registration numbers. The Financial Services Commission (FSC) disclosed the attacks in early October 2026, revealing that at least 68,000 individuals were affected across multiple entities. Tools used in the attacks included AI technologies like Claude Code and DeepSeek, which enabled the threat actor, identified as TAG-217, to exploit vulnerabilities at scale. The use of residential proxies and AI tools has raised concerns about the evolving nature of cyber threats in the financial sector. Security experts emphasize the need for adaptive defenses to counter such rapidly changing attack methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-07
Public analysis of cyberattacks
The FSC disclosed multiple financial institutions were hit, exposing personal data of at least 68,000 individuals.
Recordedfuture
2026-10-16
Research findings published
Recorded Future's Insikt Group detailed TAG-217's activities and the tools used in the attacks, including ARTEX.
Recordedfuture
Recent
Breach confirmation
The attacks have been confirmed to involve 16 institutions, including banks and cryptocurrency firms.
Securitymagazine

More articles in this cluster (4)

Following this threat?

Track Brightfix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 4

Common questions

How many records were leaked?
Approximately 100,000 personal records were leaked due to the cyberattacks.
What tools were used in the attacks?
The attacks utilized the ARTEX framework along with AI tools like Claude Code and DeepSeek.
Which institutions were affected?
The breach impacted 16 financial institutions, including banks and cryptocurrency firms.