TAG-217 Used AI Framework ARTEX to Target South Korean Banks in 2026

Threat actor TAG-217 began preparing infrastructure and assembling attack tools in August 2026, weeks before South Korean authorities disclosed cyberattacks on financial institutions, according to new research from Recorded Future’s Insikt Group. The findings extend the known timeline of the campaign that compromised multiple banking entities.

Public reporting initially indicated that the breaches exposed personal data belonging to at least 68,000 people across seven financial institutions. Insikt Group’s investigation revealed additional capabilities, including tools designed to steal cryptocurrency wallet files and gain access to Linux systems. The group also identified attempts to test weaknesses in mobile devices.

Operational Timeline and Capabilities

Insikt Group traced the actor’s activity back to mid-August 2026, when TAG-217 tested infrastructure for maintaining remote access and conducted internet scanning. Logs from this period showed repeated test connections between the attacker’s own servers but did not indicate successful access to victim systems at that time. By late August, the group had assembled tools targeting cryptocurrency mining operations using the YiiMP platform.

These tools were capable of trying default passwords, stealing wallet configuration files, and maintaining remote access. The system was configured to send Telegram alerts when credentials were captured. The research highlights that while AI enables attackers to pursue more targets, it does not prevent operational security mistakes that allowed defenders to uncover these preparations.

AI-Driven Attack Methods

In early October 2026, South Korea’s Financial Services Commission disclosed that multiple financial institutions had been hit by cyberattacks. The attacks compromised different systems at each victim entity, with one breach exposing an outsourced developer’s information and another resulting in customer data theft. Industry sources reported the use of ARTEX, a Chinese-language, open-source AI penetration testing framework.

On October 7, 2026, public analysis identified that the suspected Chinese-speaking actor used several AI tools, including Claude Code, DeepSeek, Grok, and Zhipu AI. The group used a primary server running ARTEX and residential proxies to obfuscate the origin of their activity. The variety of targets likely demonstrates the ability of AI to opportunistically test for weaknesses at scale.

What should you do?

Organizations should monitor for unusual scanning activity and connections to known malicious infrastructure associated with ARTEX. Security teams should review logs for indicators of compromise linked to TAG-217, including the specific AI tools mentioned in the analysis. Defenders should also look for signs of unauthorized remote access attempts and credential theft.

What to do and how to stay safe: TAG-217

• Monitor network logs for connections to infrastructure linked to the ARTEX framework or TAG-217.
• Review access logs for unusual activity related to cryptocurrency wallet files or Linux systems.
• Check for the use of residential proxies in outbound traffic that may indicate data exfiltration.
• Ensure that default passwords are changed on all systems, particularly those running YiiMP or similar platforms.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AI tools did TAG-217 use in the South Korean banking attacks?

The actor used ARTEX, Claude Code, DeepSeek, Grok, and Zhipu AI, according to public analysis.

How many people were affected by the data breaches?

Personal data belonging to at least 68,000 people was exposed across seven financial institutions.

When did TAG-217 begin preparing for these attacks?

The group tested infrastructure and assembled tools as early as August 2026, according to Recorded Future.