TAG-217 used Claude, DeepSeek and Grok against South Korean banks
Original title: Hackers Use Claude, DeepSeek and Grok in AI-Assisted Attacks on South Korean Banks
Cited reporting says at least 68,000 people's data was exposed at seven or more financial institutions.
Recorded Future's Insikt Group says actor TAG-217, a suspected Chinese speaker, used Claude Code, DeepSeek, Grok, Zhipu AI and the ARTEX testing framework while preparing activity linked to attacks on South Korean banks. Preparations from August 17 included remote-access tests, scans, YiiMP wallet-stealing tools, Linux privilege tools and later mobile-device experiments. Public reporting cited in the investigation says personal information of at least 68,000 people was exposed across at least seven financial institutions. The report does not show AI acted alone or measure how much it sped the attacks.
Unconfirmed: The 68,000-person figure comes from cited public reporting; Insikt does not confirm state backing or that every discovered tool was used against a bank.
- Insikt's report is dated October 16 and says preparations began in August.
- August 17-22 logs did not demonstrate successful access to victims.
- Tools tried default passwords, stole wallet files and sent Telegram alerts.
- By September 26 the environment held reconnaissance, proxy, payload and payment-check records.
- Public IoC hashes, IPs and domains were not published in the source.
Impact: personal data of at least 68,000 people reportedly exposed
- 1.Identify internet-accessible services, review permissions and fix weaknesses by data sensitivity.
- 2.Correlate proxy infrastructure with unusual sign-ins, record requests and remote access.
- 3.Review employee and partner applications as well as customer-facing services.
- Products
- Claude CodeARTEX
- Threat actors
- TAG-217
- Organizations
- Recorded FutureInsikt GroupZhipu AI
- Countries
- South Korea
From the original article
4 min read at gbhackers.com
Hackers linked to attacks on South Korean banks used Claude Code, DeepSeek, Grok, and Zhipu AI alongside ARTEX, an open-source AI penetration testing framework. The campaign shows how attackers can combine AI services with familiar hacking tools to search for weaknesses across different systems, while leaving evidence that helps investigators trace their work. Public reporting […]
By Tushar Subhra · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.