South Korean Hacker Uses Generative AI Framework ARTEX to Breach 90 Organizations and Steal 8.2 Million Records
The Seoul Metropolitan Police announced on October 26 the arrest of a 32-year-old individual identified only as A, who carried out a series of intrusions targeting around 90 companies and institutions across South Korea and exfiltrated 8.2 million personal records along with internal documents.
Approximately 60 of the victims were compromised with the assistance of generative artificial intelligence. The tool, identified as the ARTEX framework, required only the name of the target and autonomously determined the optimal attack path. Investigators noted that this level of automation enabled a single individual to achieve the scale of operations previously requiring a team of specialists.
The suspect had no formal education in technology and acquired his intrusion skills through materials freely available on the internet. Between 2019 and 2022 he worked in penetration testing at a security company. Six additional suspects remain at large under investigation.
Targets included hospitals, exam preparation courses, golf courses, universities, and subsidiaries of major corporations. After the thefts, the group demanded ransom from 38 organizations totaling 360 million won in Tether, threatening to publish the data and expose victims to regulatory fines and reputational damage. Police confirmed that 300,000 won were actually received.
The intrusions occurred between September 2025 and October 2026, with widespread use of generative AI beginning in late August 2026. The investigation was initiated in June following a complaint from one affected company. Officers traced the suspect through server logs from victim organizations and arrested him on October 15.
He has been referred to the Prosecutor's Office in custody on charges of violating the Information and Communications Network Act as well as completed and attempted extortion. Police described the case as the first large-scale incident in the country involving generative AI, stated that part of the stolen material has been recovered, and are checking for possible copies on the dark web. The total number of affected organizations may increase as the investigation continues.
Related articles
AI in Vulnerability Management: Assistant, Weapon, and Emerging Target
Artificial intelligence now plays three simultaneous roles in vulnerability management: it assists defenders with prioritization and analysis, arms attackers with faster discovery tools, and introduces entirely new classes of assets and vulnerabilities that must be managed. Mature applications include ML-driven risk scoring in platforms such as Tenable VPR, Qualys TruRisk and Rapid7 Active Risk, which cut priority lists by 40-50 percent, and Google’s Big Sleep project that discovered a real-world SQLite flaw (CVE-2025-6965) before exploitation occurred. On the offensive side, systems like XBOW completed 104 test scenarios in 28 minutes versus 40 hours for human testers, shrinking the average time-to-exploit window to negative seven days according to Mandiant M-Trends 2025. New AI-specific attack surfaces are documented in the OWASP Top 10 for LLM applications and the emerging MCP Top 10, covering prompt injection, tool poisoning, and command injection against Model Context Protocol servers. Real incidents already include Air Canada’s chatbot inventing a refund policy and New York City’s MyCity bot dispensing illegal advice for nearly two years. Researchers have also demonstrated sandbox escapes in coding agents from Cursor, OpenAI Codex and Claude Code through classic file-write-and-execute patterns rather than any sentient behavior.
Solar Unveils AI Firewall to Protect Against Dangerous Actions by AI Agents
At SOC Forum 2026, Russian cybersecurity firm Solar presented its new Solar AI Firewall solution designed to filter requests to external AI models and block prompt injections. The product sits between users and AI systems, applying multi-layer protection that responds in milliseconds and counters 200 types of attacks. Special emphasis is placed on autonomous AI agents capable of performing actions in corporate systems, where the firewall inspects operations and blocks potentially harmful ones. Integrations with DLP, SIEM, and IDM tools are supported, and the solution is available both as a cloud service and for on-premises deployment. Solar has been testing the product internally and observed significant shadow AI usage outside corporate controls. The company plans further development of comprehensive AI risk management capabilities.
TenetBench Benchmark Tests LLMs for Compliance with Professional Ethical Codes
Researchers from the Institute of Information Security Issues at ISP RAS and the Institute of Cybersecurity and Information Protection at RANEPA have developed TenetBench, a benchmark designed to evaluate how well large language models adhere to specific norms in professional codes of ethics. The benchmark generates realistic work-related prompts that may conflict with rules from documents such as the Code of Professional Ethics for Advocates or journalistic standards on undisclosed advertising. Each test case pairs a conflicting request with a neutral counterpart to measure whether models refuse, warn, or still provide prohibited content. Evaluation separates task completion, norm violation detection, and presence of explicit refusals using an LLM-as-a-Judge approach validated against human annotators. The full dataset contains 3,433 prompt pairs derived from 15 professional codes, with a public subset of 2,235 pairs from 10 documents. Human validation confirmed 99.5% of generated examples as fully plausible work scenarios.
Solar to Showcase Solar AI Firewall for Business Protection Against AI Risks at SOC Forum 2026
GK Solar will present its new Solar AI Firewall solution at SOC Forum 2026 to help organizations control interactions with AI services and prevent confidential data leaks through employee prompts. The product addresses growing risks from staff sending corporate data to neural networks and AI agents gaining access to internal systems. The forum takes place on 27-28 October in Moscow's Lomonosov cluster, with the official launch of Solar AI Firewall scheduled during the event. Solar will also highlight practical risks of AI adoption, including data transmission to external services, use of public models by employees, and new attack surfaces in corporate infrastructure. The solution will be demonstrated as part of an integrated ecosystem for access, network, and data protection. In addition, the company plans to introduce JSOC ONE, a new line of Solar JSOC services tailored for mid-sized businesses that require 24/7 monitoring without building their own SOC.