AI-powered attacks on Korean financial sectors linked to Chinese DDoS group: report

The latest attacks targeted South Korean financial institutions through a layered operation that reportedly used several AI models. Authorities suspect Pramana and ARTEX were among the tools involved. The case matters because AI may have helped attackers plan or carry out cyberattacks more efficiently, although the article does not establish exactly how each model was used.

The suspected operation used Hong Kong-based control servers, separate attack servers, and alternative access routes. These layers helped the attacker target seven financial institutions in succession. ARTEX was designed as an AI-powered penetration-testing tool, but investigators believe it was misused during the attacks.

The attacker’s identity remains unclear. The developer known as Autumn-27 said ARTEX would stop receiving updates and public distribution because of misuse, moving instead to a closed-source model. That response shows how suspected abuse can change the availability of dual-use AI security tools.

A distributed denial-of-service, or DDoS, attack is an attempt to make a website or online service unavailable. Attackers send unusually large amounts of traffic toward the target. The goal is not necessarily to steal data, but to disrupt access and prevent ordinary users from using the service.

The article describes DDoS attacks as flooding websites or online services with traffic. The flood overloads the systems supporting the service. When those systems are overwhelmed, legitimate requests compete with the attack traffic and users may be unable to reach the website or complete online activity.

DDoS attacks are especially disruptive to banks and other services that depend on constant availability. The article links GodNet’s creator, Vitas, to a Chinese group that carries out DDoS attacks for paying clients. It does not describe the specific defenses used by the targeted institutions.

The suspected attacker targeted seven South Korean financial institutions in succession. This number shows that the incident was not limited to one isolated organization. It affected multiple financial institutions during what authorities described as the latest wave of cyberattacks.

The operation reportedly used Hong Kong-based control servers, separate attack servers, and alternative access routes. Moving from one institution to another while using several server roles suggests planning and coordination. It may also have helped separate control activity from the systems directly involved in attacks.

The sequence alone does not prove who organized or carried out the breaches. Logpresso warned that account links did not establish responsibility and could not show that only one person was involved. Investigators still needed more information about the operators and the infrastructure behind the attacks.

Vitas is identified as a Chinese group that carries out distributed denial-of-service attacks for paying clients. The group created an online community called GodNet. This connection matters because investigators found accounts linked to GodNet while examining suspected links to the South Korean bank attacks.

The Telegram account YY520CN was listed as a GodNet moderator in September 2024. Logpresso also traced details of a second GodNet staff account. GitHub code linked to that member connected a Telegram account with a GodNet domain and included an email address found in stolen login data.

These connections provide investigative leads, not proof of guilt. The second GodNet member was not directly linked to the bank hacks. The identity of YY520CN’s operator remains unclear, and a later account using the same username denied involvement.

Infostealer malware collects passwords and other login details from infected devices. Those details can reveal which services an account operator used. Investigators can then compare stolen credentials with Telegram accounts, GitHub records, domains, and cloud-provider information.

Logpresso found an email address in a GitHub code edit history and traced it to login details stolen by infostealer malware in 2023. The stolen data included Microsoft and Oracle cloud-service credentials. That suggested the suspected GodNet member may have helped operate the group’s technical systems.

Investigators could compare the stolen login data with cloud providers’ subscriber records to identify the account operator. The same approach might help trace the person behind YY520CN. However, stolen credentials and account links remain leads, not conclusive proof that someone carried out the bank attacks.

Cyberattack attribution is difficult because digital clues do not automatically identify the person who used them. A Telegram username may be deleted or recreated. A phone number may be used without its owner’s permission. Credentials may belong to someone whose device was infected, rather than to the attacker.

The article gives several examples. YY520CN was linked to GodNet, but its operator remains unknown. The phone-number owner denied involvement and said someone used the number without permission. A new account later appeared under the same username, but investigators could not confirm whether the same person controlled both accounts.

GitHub records and stolen cloud credentials create additional connections, but they still do not prove responsibility for the bank hacks. Logpresso said the links alone could not establish who carried out the breaches or show that only one person was behind them.

The article does not explain how the financial institutions defended themselves. In general, organizations reduce DDoS damage by filtering malicious traffic, distributing online services across resilient systems, and preparing response plans. These measures aim to keep legitimate users connected while attack traffic is identified and blocked.

Stolen credentials require different controls. Institutions commonly use multifactor authentication, strong password practices, rapid credential resets, and monitoring for unusual logins. They also restrict cloud permissions so one stolen account cannot reach every important system. These steps address the kind of Microsoft and Oracle access found in the investigation.

Attacks routed through control servers, attack servers, and alternative routes require coordinated monitoring across networks and cloud providers. Teams can isolate affected systems and preserve records for investigators. The article shows why this matters, but it does not state which defenses the seven institutions used or whether they stopped the attacks.