[Edaily Reporter LEE YOU-RIM ] It has been revealed that “ARTEX,” a Chinese-made artificial intelligence (AI) penetration tool believed to have been used in recent hacking attacks on the domestic financial sector, was also exploited in a large-scale hacking campaign targeting approximately 90 domestic companies. The hacker arrested by police this time was a non-IT major who taught himself hacking through blogs and YouTube; investigations found that he used generative AI to steal a massive amount of personal information in a short period of time.

The Cyber Investigation Division of the Seoul Metropolitan Police Agency announced on the 26th that it had referred ringleader A (32) to the prosecution in custody on charges of violating the Information and Communications Network Act (unauthorized access and disclosure of secrets) as well as extortion and attempted extortion. The six accomplices are currently under police investigation without being detained.

According to the police, from September of last year through October of this year, the group used generative AI and other tools to hack into the systems of approximately 90 domestic companies. They are accused of stealing more than 8.2 million pieces of personal information, as well as internal business data, from institutions such as private academies, hospitals, golf courses, and subsidiaries of major corporations.

The investigation revealed that Mr. A, the ringleader, had no formal background in IT but taught himself the necessary skills through blogs and YouTube. He then worked as a penetration tester at a security firm from 2019 to 2022. In the early stages of the crimes, Mr. A conducted manual hacking using website vulnerability scanning tools. These traditional tools had limitations: attackers had to manually select the appropriate tool for each specific environment and enter commands one by one.

However, the nature of the crimes changed dramatically when A began fully integrating “Artex,” an AI-powered autonomous penetration testing system, with a coding agent tool in late August of this year. Once a target site was specified, the system would automatically select the appropriate tools for the situation and exploit vulnerabilities in databases (DBs) and administrator pages. Since the AI made its own decisions and carried out the penetration without user intervention at every step, the speed and scale of the crimes expanded rapidly.

Mr. A targeted companies that appeared at the top of portal search results and were “financially capable of paying settlement fees.”

By industry, three insurance sales companies suffered the largest number of leaks—3.22 million records—while three funeral service companies had 1.43 million records stolen. This was followed by 21 golf courses (1.2 million records), 12 private academies (990,000 records), 5 hospitals (220,000 records), 4 universities (20,000 records), and 42 other businesses (1.12 million records). The leaked information included names, resident registration numbers, contact information, and addresses. It also included patient consultation records from hospitals, personal information of minors from private academies, management systems of major conglomerate affiliates, and information from internal bulletin boards at regional secondary financial institutions.

After the hack, the perpetrators continuously sent threatening emails and text messages to the affected companies, warning, “If you do not comply with our demands, we will disclose the data breach.” Investigations revealed that they demanded a total of 360 million won in cryptocurrency (Tether) and other forms of payment from 38 companies. However, because the police apprehended them early on, the actual amount extorted was limited to 300,000 won transferred by one small business (charged with extortion), while the remaining demands totaling 360 million won were charged as attempted extortion.

The police have identified this case as a prime example of the lowering barrier to entry for AI-enabled crimes and responded by deploying “in-house developed, customized AI” in their investigation.

The Seoul Metropolitan Police Agency, with support from the National Investigation Bureau in the form of high-performance AI computers, established an “internal network generative AI analysis system” that prevents investigative data from being transmitted externally, and developed and applied three specialized tools, including one for analyzing network intrusion logs. The investigation team rapidly analyzed vast amounts of data, apprehending all suspects and recovering the stolen personal information just four months after the investigation began.

The police plan to continue the investigation, including looking into allegations involving companies that have not yet reported damages and tracking the proceeds of crime. A police official stated, “We plan to expand the use of AI in the field to counter sophisticated crimes that exploit AI,” and urged the public, “Even if you receive threats regarding data leaks, do not negotiate with the perpetrators or send money; please report it immediately.”