Executive Summary

Key Numbers

Sources: ZDNet Korea and Electronic Times (Seoul Metropolitan Police Agency announcement), the reproduction by Soongsil University's AI Safety Research Center, and CSOonline (Microsoft Threat Intelligence analysis). The pace-per-period conversion was computed by Pebblous from the published figures.

On October 26 the cyber investigation division of the Seoul Metropolitan Police Agency announced that it had arrested seven people who hacked about 90 Korean companies and demanded money for the data they took. The ringleader, a 32-year-old man, was detained and referred to prosecutors; six accomplices were referred without detention. The investigation began with a complaint filed in June by one of the victim companies.

The offenses ran from September 2025 to early October this year, about thirteen months. Roughly 8.2 million personal and internal records left those companies over that stretch. The industry breakdown reads like a map of ordinary life.

Company counts and record counts do not track each other. Three insurance sales firms account for 3.22 million records, close to 40% of the total, while 21 golf clubs yield 1.2 million. How much comes out of a single break-in differs sharply by industry, so the number of companies breached says little about the size of the loss.

Source: the Seoul Metropolitan Police Agency announcement as carried by ZDNet Korea. The company counts add to 90 and the record counts to 8.2 million.

Names and phone numbers were not the whole of what left. Resident registration numbers and home addresses went with them; from the hospitals, treatment and counseling records; from the academies, data on minors; from the non-bank financial firms, material posted on internal bulletin boards. Not one record of that kind can be gathered back.

The way targets were picked is on the record too. He chose companies that ranked high in portal search results and looked able to pay a settlement. The 38 he settled on were asked for 360 million won in total, and the money that actually arrived was 300,000 won from one small business. Holding 8.2 million records, he collected less than 0.1% of what he demanded. The damage in this case piled up on the record side rather than the money side.

The ringleader's résumé sets this case apart from an ordinary hacking case. He never studied IT, and he picked up hacking from blogs and videos. He did hold a penetration-testing job at a security firm from 2019 to 2022, but he was not the kind of expert who opens the networks of 90 companies across a country single-handed. That is the point police underlined in the announcement: large-scale hacking no longer takes a professional crew, only AI to help.

He did not use AI from the start. For the first twelve of those thirteen months he worked through targets one at a time with ordinary vulnerability scanners. At the end of August he began pairing ARTEX with a coding agent in earnest, and the method changed with it.

Measured on the same scale, the two stretches sit far apart. The earlier one covers about 350 days and 30-odd companies, which averages out to roughly twelve days each. The later one covers 40-odd days and 60 companies, more than one a day. The pace rose more than tenfold. Since the police figures for 90, 60, and thirteen months are all approximations, that multiple should be read as a direction rather than a statistic. No choice of rounding brings it down to single digits, and that much the arithmetic does settle.

The reason the pace jumped lies in the kind of work ARTEX does. It is less a language model that writes its own answers than a conductor that calls several AI models in as teammates. A planner fixes the objective and the order of work, and several workers divide asset discovery, vulnerability checks, and command execution among themselves. The person types one line with an address and a purpose, then waits for the result. CrowdStrike, which analyzed the attack on Korean financial firms, said the ARTEX instance used there ran DeepSeek as its main model. The model slot is a part that can be swapped out.

Whether that description is overstated has been tested on the record. On October 6 the AI Safety Research Center at Soongsil University published the results of a reproduction. The researchers stood up an isolated mock financial service built from invented people and synthetic data, then attached ARTEX to it. The instruction was a single line: the target domain, the purpose, and a request to show whether someone else's records could be read without authentication. Finding the vulnerability and proving it took about six minutes, and by way of missing authentication and weak access control the tool read all 100 customer records in the mock database without logging in.

This arrest is not ARTEX's first appearance. Within about ten days of each other, attackers of entirely different character turned up carrying the same tool. So this case does not close as one person's crime.

The first is Korean finance. On October 4 financial authorities assessed that breaches had occurred at seven firms: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. On October 7 CrowdStrike said it had identified an ARTEX instance and an externally exposed directory on a server connected to the attack. Inside were penetration-testing instruction files written in Chinese and details of an operations server in Hong Kong, and that Hong Kong server held work-session logs and ARTEX configuration files. The traffic came in through more than 20 addresses scattered across more than ten countries, including the United States, Japan, and Germany, which is why nobody has been named for this one. CrowdStrike's own reading of this attacker leans away from a state-run program and toward a financially motivated single actor or small team.

The second is a state-linked group. Microsoft Threat Intelligence analyzed Storm-0940, which it classifies as linked to the Chinese state, as having used ARTEX against some 2,250 organizations running Microsoft 365. The method runs like this: sign in with credentials stolen from a backup application, run reconnaissance, tamper with application credentials to hold the position, then alter privileged roles. The speed is not human work. It made 2,900 sign-in attempts a minute, and in some cases took admin-level cloud access within three hours of settling on a target. Microsoft said the activity "demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially."

The third is the self-taught individual arrested this month. Budget, headcount, and skill put the three nowhere near one another, and the tool all three reached for was the same one. The same trace has surfaced in Japan. According to Korean coverage of Japanese reporting, a security subsidiary of GMO Internet Group analyzed attacks aimed at Japanese companies between September 18 and October 18 and found ARTEX traces on all six of the overseas servers involved.

ARTEX was meant for penetration testing and security research inside an authorized scope, and it is still used that way. An installation trace or a matching string on a server does not by itself establish that the server was used in an attack. What ties the three cases above together is session logs, configuration files, and analysis of the attack activity itself, not the presence of an installation.

ARTEX was built by a security engineer in China who goes by Autumn-27 on GitHub. The repository went public in July under the AGPL license. After the attacks on Korean financial firms became known, he posted on GitHub on October 8 that the tool had been abused, that ARTEX would no longer be updated, and that the source would move to a private repository. He added that no further versions would be released and that he would not maintain it. The original repository page did disappear.

That declaration did not undo the tool's availability. Copies already downloaded cannot be recalled. A separate repository holding a backup of the earlier source stayed public, and a Korean fork has been reported as well. The dates make the sequence clearer. On October 7, the day before the developer announced the halt, a Korean-localized ARTEX with detection rules added went up on GitHub.

A free license like the AGPL guarantees that whoever receives the software may redistribute it. It carries no clause that stops redistribution of copies already out, even when the original author changes his mind. In security tooling that property cuts both ways: defenders can take the tool apart and write detection rules because of the same guarantee. Still, the part that cannot be recalled is permanent, while taking the tool apart costs people time. The attacker stays ahead by exactly the gap between release and response.

For anyone drawing up a defense plan, the conclusion here is plain. Blocking the circulation of one tool is not a measure. Forks under new names will keep coming, and if those are blocked, a tool of similar design fills the space. The thing to plan against is the speed this tool made possible. More than one company opened a day, administrator rights handed over inside three hours: the gap between detection and response has to be measured again on those terms.

The quietest number in this case is the count of reports. Of about 90 victim companies, 15 went to the police. The other 75 stayed silent, whether they knew their data had gone or never found out at all. The side that did not report is five times the size.

There is a calculation of a sort behind staying silent. A report brings an inspection, and fines, lawsuits, and reputational damage follow. Keep quiet and it can look as though nothing happened. In this case it would have looked exactly that way. Only one company paid, so a company that was threatened and held out could file the episode away as having cost it nothing.

The trouble is that the data side of the ledger does not close there. No money changing hands does not mean the files came back. Resident registration numbers, treatment records, and data on minors are already in the attacker's hands, and nobody knows how many copies exist or where they went. Without a report, that leak is entered in no ledger at all. The data subjects themselves are never told that their information left.

This time the police investigation brought the other 75 to light, and the stolen personal data was recovered. But that came out of an investigation that ran for four months from a single complaint filed in June. Without it, only the 15 companies' share of the 8.2 million records would have entered the record, and the rest would appear in no statistic and no breach tally. The two numbers in this case, 15 and 90, give a sense of how much of the real thing our breach statistics are looking at.

Police brought AI into those four months as well. A high-performance AI computer provided by the National Office of Investigation, an in-house generative-AI analysis system, and three dedicated tools for combing intrusion logs were all put to work. Retracing what one person did with a public tool took an investigative organization and that much equipment. The announcement that police plan to widen AI adoption in the field came from the same briefing.

Organizing data so that AI can read it has been, until now, almost entirely a good thing. Tidy schemas, standardized access paths, and descriptions attached as metadata all let a model work that much better. And a tool like ARTEX combs exactly that tidy surface. To an agent that finds its own way into admin pages and database structures, well-organized data is well-organized data.

None of that adds up to an argument for stopping. Leaving things messy is no defense. It is only a slower leak, and the vulnerabilities the Soongsil experiment walked through were missing authentication and weak access control. The problem sits with the scope of the tidying. When access control and leak logging fall outside the data plan, every step forward widens only the surface that is easy to comb.

So the case leaves four questions for anyone who is responsible for data.

• • Which surface of our data is visible from outside. The victims here were golf clubs, academies, and clinics, ordinary web services left open so that people can book a tee time, sign up for a class, or see a doctor. Assets like these rarely make the list a large enterprise's security team guards, and to something that combs automatically, that ordinariness is the selection criterion
• • Whether authentication and access control sit inside the data plan. When choosing schemas and setting quality metrics belongs to one department and deciding who may see which rows belongs to another, every step one side takes widens the opening on the other
• • Whether a departure of data leaves a record. If there is no trace of which range of which table was queried, when, and to where, the only honest answer to a question about a leak is that nobody knows. Among the 75 that did not report are cases that could not assemble anything to report
• • Whether the gap between detection and response runs in days or in hours. A weekly check does not catch an attack that takes administrator rights in three hours. The thing to measure is the time that actually passed between intrusion and awareness. How many security tools are in place does not report that time

When we talk about AI-Ready Data, we usually picture the data a model will use. This case shows that the same data can be just as ready for an attacking agent. Making data usable by AI and deciding who that AI is have to be one piece of work. In an organization where the two are split, the faster the tidying goes, the wider the opening goes with it.

Thank you for reading this far. The facts here were checked against the October 26 and 27 reports carrying the Seoul Metropolitan Police Agency's announcement, the published materials from the reproduction by Soongsil University's AI Safety Research Center, and the analyses from CrowdStrike and Microsoft Threat Intelligence. The pace-per-period conversion was computed directly from the published company counts and timespans, and Section 2 notes that the original figures are approximations. If more of the investigation is released, or if detection rules for ARTEX-class tools are consolidated, we intend to come back to it. We would be glad to hear how often you check data access logs and leak detection inside your own company.

Pebblous Data Communication Team
October 28, 2026

Arrest Coverage

• 1.ZDNet Korea. (2026). "Group that hacked some 90 companies with generative AI arrested." October 27, 2026. Source for the industry breakdown, the extortion amounts, and the number of companies that reported.
• 2.Electronic Times. (2026). "Hacking group arrested for abusing an AI autonomous penetration testing system." October 26, 2026. Source for the 8.2 million total records taken and the date ARTEX entered use.

ARTEX Analysis and Reproduction

• 3.ZDNet Korea. (2026). "We ran an ARTEX hacking simulation: one line of instruction, 100 personal records in six minutes." October 6, 2026. Source for the conditions and results of the reproduction by Soongsil University's AI Safety Research Center.
• 4.CSOonline. (2026). "China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants." Source for the Storm-0940 attribution, the 2,250 organizations attacked, the 2,900 attempts per minute, and Microsoft's statement.
• 5.Kyunghyang Shinmun. (2026). "Chinese-built AI 'ARTEX', used in the chain of attacks on Korean finance, halts open development." October 10, 2026. Source for the developer Autumn-27's announcement of the move to a private repository.
• 6.Newstap. (2026). "CrowdStrike detects 'ARTEX' attacks aimed at Korean financial firms." Source for the ARTEX instance and session logs found on the attack servers, and for the assessment of the attacker's character.