South Korea's bank hacks: the attack side automated first
The week ran from one bank's bad Wednesday to a presidential cabinet session. On September 30, data on about 25,000 Shinhan Bank customers leaked (Yonhap). By Tuesday, a full-scale police investigation covered seven South Korean financial institutions, the Financial Services Commission (FSC) counted 68,000+ affected people, and the president told his cabinet there are signs AI was used in some attacks (The Star).
Banking was supposed to be the hard target. The moat held for a boring reason: attack labor cost human hours. A credential-stuffing campaign against a bank takes weeks of triage. The suspected toolset is an open-source multi-agent pentest framework. Human hours stopped being the binding cost.
What happened, day by day?#
| Date | Confirmed |
|---|---|
| Sept 27 | Hyundai Capital breached, data on 146 loan agents taken |
| Sept 30 | Yegaram Savings Bank leaks data on about 40,000 people. Shinhan's breach happens the same day, confirmed at once (Seoul Economic Daily) |
| Oct 1 | Shinhan goes public: about 25,000 customers, names, phone numbers, annual income (Yonhap, Bloomberg). Financial Supervisory Service (FSS) starts an on-site inspection |
| Oct 2 | KB Kookmin reports 119 customers hit via external intrusion. Attempts confirmed at all five major banks plus BNK Busan (Chosun) |
| Oct 4 | President demands a thorough investigation (Yonhap). Hana: 89 customers affected, Woori and NH Nonghyup repel attacks without leaks. FSC emergency meeting orders firms to block external access without a production need |
| Oct 5 | Chosun maps the spread into savings banks and capital finance, Welcome Savings Bank among them. FSS and FSI shortlist: 28 IP addresses across 12 countries (Yonhap) |
| Oct 6 | Cabinet: Lee cites signs of AI use in some attacks (The Star). Police open a full-scale case: 28-member team, ICT networks act |
Counts wobble by source: Korea Herald put Kookmin at 153 individuals, three outlets report 119, this piece uses 119.
What do officials actually claim about AI?#
Less than the headlines imply, and the hedging is the finding. President Lee Jae Myung at the cabinet, in AFP's translation: "There are signs that artificial intelligence was used in some hacking attacks, causing considerable concern and anxiety among the public." The line for anyone shipping software: "We have now reached a point where AI can make (hacking) easy for even those without special skills" (The Star). FSC chairman Lee Eog-weon held the same temperature on Sunday: "We cannot rule out the possibility of attacks using AI" (Korea Herald via Straits Times).
The strongest claim in circulation is anonymous. A senior official told AFP it is "highly likely" that Artex AI was used, and officials add that a Chinese-built tool says nothing about the attackers' nationality (The Star). Reuters records no tool names disclosed (via Livemint); Seoul Economic Daily calls ARTEX's role unconfirmed. Signs, likelihood, traces. Eight days in, that is the attribution.
Why the economics is the real headline#
Artex AI is an LLM multi-agent system for autonomous penetration testing, open source on GitHub, mostly Chinese-language, a winner of a Baidu "Agent+" security challenge this year (Seoul Economic Daily). The entry fee for a serious attack harness is a git clone and an API key.
What got cheap is not the exploit. It is the triage: which leaked credentials still answer, which soft endpoint earns the pivot. Humans paid for that in weeks. Ryu Jae-cheol of Chungnam National University compressed the mechanism for Chosun: "AI can identify vulnerabilities that humans might overlook."
September priced the precedent: three open-source agent frameworks breached at least 27 online shops almost unattended, at a mean of $25.46 per completed scan (my reconstruction). Seven financial institutions in under two weeks, one suspected operator, is the same design aimed at targets with auditors.
Where did they get in?#
Through the side rooms. The documented entries are peripheral business systems: a service for loan brokers, sales platforms (KED, Chosun). Kookmin and Hana say the hit systems sit separate from internet and mobile banking (KED). No core ledger, no payment rail. The side rooms held the data anyway.
Core services get threat models and pen tests, the loan-broker portal gets a feature deadline. In my banking-backend walkthrough on Laravel 13, the defenses that matter are the boring ones: idempotency keys, fail-closed boundaries, queues that cannot cross module walls. This week showed where the market for entry points actually clears.
The automation trace sat in a header string#
The ARTEX find took no forensics: a server tied to credential-stuffing and API attacks carried a header string pairing "ARTEX" with the Chinese for "autonomous penetration testing console" (Seoul Economic Daily). Somebody read raw headers. Moon Jong-hyun of Genians Security Center stayed at reasonable suspicion: AI-based attack automation, nothing firmer.
Addresses are the weakest signature: the same IP turned up in all seven victims, a single perpetrator not ruled out (Chosun). Park Sang-won of the Financial Security Institute gave the hard limit: an IP alone identifies nobody. Attackers move between addresses (The Star). Frameworks leak their defaults: a console name in a header, a User-Agent no browser sends, timing no hand produces.
The outbound half lives here: every tool result the support agent accepts is schema-validated, and after OpenAI scrapped GPT-6.1 Astra over scope and deception failures, trace assertions joined the queue. Inbound costs less: log full request headers and alert on strings no human wrote.
Would your logs have caught it?#
The FSS gave the sector until October 8 for emergency checks, with a sector-wide security rebuild in preparation (Korea Herald via Straits Times). Regulators work in deadlines. You can work in ten minutes: pull full request headers from one public endpoint and read them, looking for a product name you did not put there.
Agent frameworks leave residue everywhere, and the Korean case turned on one header line. If a multi-agent harness had spent an afternoon on your backend last week, what exactly would have noticed?