Securityairansomwaresouth-korea
A self-taught Seoul hacker used an AI pentest agent to breach 60 companies in 40 days, took 8.2 million records, and collected about $210
Seoul police referred a 32-year-old former mock-attack tester to prosecutors for breaching more than 90 organizations; his gang demanded 360 million won from 38 of them and got 300,000 won from one.
The suspect, identified only as A, has no IT background. He studied arts and physical education, taught himself hacking from YouTube, and from 2019 to 2022 did simulated attacks for a security firm, the Seoul Economic Daily reports. The Korea Times, running Yonhap’s report, describes him as someone who learned hacking while doing mock attacks at a security company.
For about a year he worked the slow way, with vulnerability scanners, against academies, hospitals, golf courses and universities. Then he moved to an AI coding agent and an autonomous AI penetration-testing system, and from August 31 to October 13 he breached 60 companies. BleepingComputer reports the tool was ARTEX, “the same autonomous framework used in the attacks against multiple South Korean banks.” Police told the Seoul Economic Daily that the same autonomous pentest tool showed up in a recent financial-sector breach, and that no link between the two cases has been confirmed.
Fifteen companies have reported damage so far. A funeral services provider lost 1.22 million records on its own, and the academy data included minors.
The money end of the operation was the part that didn’t scale. According to Korea JoongAng Daily, threat emails went to 38 organizations: “If you don’t pay, we will leak the information.” The Seoul Economic Daily says the emails warned of image damage, fines and lawsuits. When companies ignored them, accomplices called and texted executives and staff. Those accomplices answered a Telegram ad: “Looking for people to make simple phone calls for pay. Takes just 30 seconds.” The pay was 10,000 to 30,000 won a call. A 24-year-old, B, kept in touch with A, obtained accounts and did the recruiting, and the accomplices ranged from their 20s to their 50s.
The combined demand was 360 million won. One company paid 300,000.
The case started in June with a single complaint and became a full investigation in August. Police arrested five of the callers between July and September, detained B in early October, and arrested A on October 15, according to JoongAng Daily. They seized a laptop, burner phones and a router and recovered the stolen data. They also used AI of their own: an in-house tool went through about 530,000 items of evidence, which the Seoul Economic Daily says let one team arrest seven people in about four months.
“Crime exploiting AI is evolving to a level that is difficult to counter with existing investigative methods alone,” Oh Gyu-sik, head of the Seoul police’s Cyber Crime Investigation Unit 2, told the Seoul Economic Daily, and he urged companies not to pay and to report. Six accomplices are still under investigation without detention, and police told JoongAng Daily they are working “to identify additional victims,” which means the count of 90-plus organizations is the floor.
The ringleader’s referral to prosecutors came on Friday, and police announced it the following Monday. How many of the 38 organizations that got the threat email are among the 15 that have reported damage is something police haven’t said yet.