TAG-217 Targets South Korean Financial Services with ARTEX
TAG-217 used the ARTEX AI framework in attacks that exposed data on 68,000 people at South Korean banks.
Recorded Future's Insikt Group says the actor it tracks as TAG-217 was testing infrastructure and assembling tools from mid-August 2026, weeks before attacks on South Korean financial institutions became public. The Financial Services Commission disclosed in early October that multiple institutions were compromised, and public reporting said personal data of at least 68,000 people across at least seven firms was exposed. The campaign used ARTEX, a Chinese-language open-source AI penetration-testing framework, together with Claude Code, DeepSeek, Grok, and Zhipu AI, and routed traffic through residential proxies. Exposed directories also showed tools for YiiMP cryptocurrency-wallet theft, Linux credential access, and mobile-device testing, though those efforts were not shown to have succeeded.