Additional evidence has emerged suggesting that a suspected attacker behind a series of hacking incidents targeting South Korea's financial sector was affiliated with a Chinese hacking organization. Police have expanded their investigative team, while the Chinese-developed AI penetration testing tool 'ARTEX' (Artificial Intelligence Testing eXploit), which was exploited in the attacks, has ceased public development.
According to industry sources on the 11th, Logpresso, a cybersecurity firm, confirmed in a recent report that an account linked to the financial sector hacking suspects had been active within the Chinese DDoS (Distributed Denial of Service) attack-for-hire group 'GodNet·VITAS.'
Logpresso cross-analyzed Telegram member lists, GitHub activity records, and leaked authentication data. The account 'YY520CN,' suspected of being connected to the attacker, was found listed as a 'Community Supervisor' managing members within the organization.
Earlier, CrowdStrike, a U.S. cybersecurity firm, identified a 26-year-old individual from Guangdong, China, as a potential suspect based on personal information exposed while creating a resume using the AI coding tool 'Claude Code.'
The accused individual denied involvement, claiming their personal information, including their phone number, had been misused, just before Logpresso's report was published.
While the attacker's exact identity remains unverified, police have expanded their dedicated financial sector cybercrime investigation team from 28 to 43 members. An additional 15 personnel specializing in digital forensics and international cooperation have been deployed to trace the attacker and clarify the incident's circumstances.
Previously, the Chinese government stated it was unaware of specific details regarding the alleged involvement in financial sector hacking and reiterated its consistent opposition to hacking activities, emphasizing lawful crackdowns.
The Chinese-developed AI penetration testing tool used in the financial sector attacks has halted public development. The ARTEX developer cited misuse of the tool as the reason for discontinuing public source code releases and updates, transitioning to a private development model.
ARTEX is an automated tool linked to Large Language Models (LLMs) for information gathering, vulnerability scanning, and attack validation. Originally designed for security testing, it sparked controversy after being implicated in the financial sector hacks.
