Chinese-Developed Hacking Tool Found on Servers Behind South Korean Bank Breaches
Shinhan Bank, KB Kookmin Bank and several other South Korean financial institutions were breached in late September using a publicly available AI penetration-testing tool, though investigators say its open-source availability complicates attributing the attack to any specific actor.
SEOUL — South Korea's Korea Financial Security Institute has confirmed that ARTEX, a Chinese-developed, open-source AI penetration-testing tool, was found on servers linked to a wave of cyberattacks against the country's financial institutions in late September. Investigators caution, however, that because the tool is publicly available on GitHub, its presence alone does not establish that the attacks were carried out by a Chinese state or state-linked actor — only that whoever carried them out used a tool with Chinese origins.
The breaches occurred between September 27 and 30, 2026, and hit peripheral internal systems at the targeted institutions rather than customer-facing banking platforms, according to the institute. Shinhan Bank reported the largest exposure, with 25,729 records leaked; KB Kookmin Bank reported 119 records affected. Hana Bank, BNK Busan Bank and several savings banks were also named among the institutions hit.
South Korea's National Police Agency has opened a formal investigation, assigning 28 investigators to trace the source of the attacks. No arrests or specific attribution to an individual or group had been announced as of this writing.
The incident adds to a string of cybersecurity scrutiny facing South Korean financial institutions, where regulators have pushed banks in recent years to harden internal network segmentation specifically to prevent breaches of peripheral systems from reaching customer-facing infrastructure — a distinction investigators say held in this case, even as the volume of leaked records at Shinhan Bank raises questions about how an attacker reached internal systems in the first place.