The attack server came with a résumé

The Sunday agenda: find out how the customer data escaped. South Korean President Lee Jae Myung ordered a thorough investigation on October 4 after a string of breaches at banks and other financial firms. Financial regulators held an emergency meeting with affected firms. A restful weekend for the security department, then.^[1]

Yonhap reports that authorities are examining incidents at seven financial firms and found overlapping attacker IP addresses. They suspect AI tools helped automate attacks at scale. Suspect is doing useful work in that sentence. Keep it there. The evidence does not establish which AI system did what.^[2]

Now comes the clipboard cavalry. The Financial Supervisory Service distributed attack information and security precautions to about 500 firms. Banks and card companies must finish emergency checks by October 6; securities firms, insurers, savings banks and electronic-finance firms have until October 8. The checklist covers exposed services and security controls, among other items.^[2]

Viddy the thrilling future: machines may help attackers work faster, while defenders rediscover the exotic discipline of checking what faces the internet. My favourite innovation is still a door that closes properly. Seven firms under investigation is quite enough material without dressing the uncertainty in a robot costume.

October 6: the investigation continues

At an October 6 cabinet meeting, Lee said signs of possible AI use had emerged in some hacking incidents. Police have launched a full investigation. Authorities had not disclosed the AI tools involved or established that autonomous models caused the breaches. The suspicion remains a suspicion; the investigation is the news.^[3]

October 7: the attack surface finds a collection plate

Now the same basic pattern has moved beyond banks. Reuters reports that Yoido Full Gospel Church and Sarang Church are investigating suspected attacks after Oasis Security found church data, account information and attack records on an overseas server. Yoido said its initial analysis indicated that information tied to 850,000 members may have been exposed. Names and dates of birth were involved, with smaller subsets containing changes to national identification numbers, addresses and phone numbers.^[4][6]

The useful clue is not a robot costume. Investigators found references to “sub-agents” and consistent attack handover reports summarizing results, internal systems and credentials. SBS reported 197 attempted logins across churches and denominations nationwide, while confirmed intrusion and leak evidence remained limited to the two named churches. Different infrastructure and a different suspected model suggest a separate actor from the bank attacks, but do not prove one.^[4][5]

That is the less theatrical problem. Cheap models can turn intrusion work into a managed production line: analyze, document, hand off, repeat. Religious nonprofits hold identity data, family connections and sometimes decades of donation history, yet SBS reports they fall outside South Korea’s mandatory cyber-incident reporting rule for information and communications service providers. A million-record institution, apparently regulated like a bake sale. Tremendous work. AI did not invent theft. It gave the thieves staff.^[5][7]

October 8: the attack server came with a résumé

CrowdStrike’s October 7 report adds evidence to the bank investigation: exposed Claude Code histories, ARTEX configuration files and memory files from infrastructure linked to the campaign. The firm says the activity ran from late September into early October and involved data theft.^[8]

Its analysis describes a Hong Kong-based primary server and a second server running ARTEX, an open-source agentic penetration-testing tool. Sessions included questions about selling Korean breach data. One user also requested a security-researcher résumé describing results from the ARTEX activity.^[8]

Viddy the career development, droogs. The server room apparently needed a recruitment desk. A résumé request is a magnificent breadcrumb; it is not a conviction.

CrowdStrike assesses with moderate confidence that the actor was Chinese-speaking and financially motivated. It cannot definitively link the résumé’s personal details to the attacker. Neither its report nor Reuters’ October 8 account establishes state direction or that every intrusion was fully autonomous. The bank findings also do not establish a common operator with the church attacks.^[8][9]

The useful advance is evidence of the toolchain. The punchline is the paperwork. Human ambition continues to ship with debugging information.

October 9: the public release ends

ARTEX’s developer said in an October 8 GitHub statement that the project would no longer be updated, would become closed source, and would provide no further public versions or maintenance support. The author condemned unauthorized misuse and said the tool was intended for authorized security testing. Reuters reported the decision on October 9 and said the project’s GitHub page had been taken down.^[10][11]

Closing the public page is not a recall button. The announcement does not establish that copies already obtained have been disabled, that abuse has stopped, or that every private development effort has ended. The change is to the project’s stated distribution and support policy; the earlier uncertainty about the attacks and their operator remains.