AI-assisted ARTEX activity tied to South Korean bank data exposure
October 19–20 reports add Insikt’s October 16 TAG-217 findings: August preparations, exposed tooling, and at least 68,000 people at seven or more institutions, without confirmed early access.
Researchers say AI tools and ARTEX were used around South Korean banks; confirmed access is limited and exposure figures differ.
Recorded Future’s Insikt Group says suspected Chinese-speaking actor TAG-217 used Claude Code, DeepSeek, Grok, Zhipu AI and ARTEX while preparing activity linked to South Korean banks. Preparations from August 17 included remote-access tests, scans, YiiMP wallet tools, Linux tools and later mobile experiments; August 17–22 logs did not show successful victim access. Cited public reporting says at least 68,000 people’s data was exposed at seven or more institutions. GBHackers also cites earlier Zscaler reporting of SQL injection against peripheral South Korean financial applications and theft affecting about 67,000 people. Zscaler describes attempted investigations across several sectors through October 4, while Microsoft says China-aligned Storm-0940 used ARTEX against more than 2,250 tenants.
- Insikt’s October 16 report traces TAG-217 preparations to August 17.
- By September 26 the environment held recon, proxy, payload and payment-check records.
- GBHackers and Cyber Security News cite at least 68,000 people at seven or more institutions.
- Earlier Zscaler reporting, via GBHackers, puts the theft at about 67,000 people.
- Microsoft says Storm-0940 tried more than 2,250 tenants at about 2,900 sign-ins a minute.
- Published articles did not include public IoC hashes, IPs or domains from the Insikt work.
Timeline
dated events in the reporting · oldest first- Aug 4, 2026Operator prompts naming multiple sectors begin, Zscaler says. · GBHackers
- Aug 17, 2026TAG-217 preparations, including remote-access tests, begin. · GBHackers
- Aug 22, 2026Logs show YiiMP tools but not successful victim access. · Cyber Security News
- Sep 26, 2026Environment holds reconnaissance, proxy, payload and payment-check records. · GBHackers
- Oct 4, 2026Dated prompts covering attempted investigations end, Zscaler says. · GBHackers
- Oct 16, 2026Insikt Group publishes its TAG-217 report. · GBHackers
What each outlet adds
beyond the shared facts- GBHackersInsikt timeline, 68,000-person figure, and September 26 environment contents.
- Cyber Security NewsOpen directories, October 7 model analysis, and unconfirmed target access.
- GBHackersZscaler’s 67,000 figure and Microsoft’s Storm-0940 sign-in volume.
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
TAG-217 used Claude, DeepSeek and Grok against South Korean banks
Cited reporting says at least 68,000 people's data was exposed at seven or more financial institutions.
- · 5d ago
Cyber Security News
TAG-217’s South Korea bank operation exposed its own tools
Open directories showed crypto, Linux and mobile tooling; cited breaches cover at least 68,000 people.
- · 3d ago
Storm-0940 used ARTEX and AI coding agents against many targets
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
- · 3d ago
CyberCartel used Claude and Grok against 400-plus financial firms
Straiker reviewed the group’s CARLIY0S system and a snapshot of 4,493 records, without confirming every target was breached.
- · 3d ago
Criminals used Claude, Grok and Kimi against Latin American finance targets
Straiker says more than 400 organizations were targeted, not that each one was breached.