South Korean police have identified and arrested seven suspects linked to a cybercrime operation whose leader, a former penetration tester, used the ARTEX AI penetration-testing framework in most of the attacks, BleepingComputer reported on 26 October 2026, citing the Seoul Metropolitan Police via local media including Yonhap News.

According to BleepingComputer, the leader, a self-taught 32-year-old who worked at a cybersecurity company between 2019 and 2022, began attacking organisations in September 2025 with conventional tools and adopted AI tools in late August 2026; he was arrested on 15 October, formally detained two days later and referred to prosecutors on 23 October, while the other six remain under investigation without detention.

Police said the operation breached more than 90 organisations in South Korea, including educational institutes, hospitals, large corporations and golf courses, stole about 8.2 million records and demanded 360 million won (about US$270,000) in 38 of the incidents, according to BleepingComputer citing Yonhap (figures not independently verified).

BleepingComputer reports police opened the case after a victim complaint in June, traced the suspects through server logs from the breached organisations, and told Yonhap it was the first arrest in Korea for a large-scale hacking and personal-information theft case that exploited generative AI; police are now checking whether stolen data has been leaked on the dark web.

BleepingComputer says ARTEX is the same autonomous framework used in attacks on multiple South Korean banks attributed to a Chinese-speaking threat actor.

Correction (27 Oct 2026): the card date has moved from 26 to 27 October 2026, the Perth date of BleepingComputer's report (26 October US time; 5:08 am 27 October Perth). (source: BleepingComputer)