Artificial intelligence is changing cybersecurity on both sides of the battlefield.
Security teams are using AI to identify vulnerabilities, analyze threats, automate investigations, and improve defensive operations. At the same time, threat actors are increasingly using AI powered tools to accelerate reconnaissance, automate testing, generate scripts, analyze targets, and support data theft.
A recent campaign targeting several South Korean financial organizations demonstrates how concerning this trend can become.
According to Cyber Security News, a suspected lone threat actor used an AI powered penetration testing tool called ARTEX to target banks, savings banks, capital companies, and online lending organizations between late September and early October 2026. Reported victims included Shinhan Bank, Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Hyundai Capital, Welcome Savings Bank, and online lending companies, although the complete number of affected organizations remains unconfirmed.
The incident is significant because it demonstrates that AI does not necessarily need to create a completely new attack technique to increase cyber risk.
Instead, AI can make existing techniques faster, more scalable, and easier for a single operator to coordinate.
AI Can Amplify the Capabilities of a Single Attacker
Traditional large scale cyber campaigns often require multiple specialists handling reconnaissance, vulnerability discovery, scripting, infrastructure management, exploitation, and data analysis.
AI assisted tools can reduce the amount of manual effort required across these stages.
In the reported South Korean campaign, investigators found evidence that ARTEX was being used alongside several AI models and development environments. Researchers from CrowdStrike reportedly discovered exposed configuration and session artifacts that provided insight into the infrastructure and AI tools associated with the activity.
The important security lesson is not that AI independently performed every stage of the attack.
The bigger concern is that AI can act as a force multiplier.
An attacker can potentially use AI to accelerate:
• Target research
• Security testing
• Vulnerability analysis
• Code and script generation
• Command development
• Documentation
• Data analysis
• Infrastructure management
• Attack workflow coordination
This can shorten the time between identifying a potential target and attempting an intrusion.
The Attack Did Not Need to Start With Core Banking Systems
One of the most important lessons from the reported incidents is that attackers do not necessarily need to compromise a bank’s primary banking platform to obtain valuable information.
The campaign reportedly focused on connected services and supporting applications.
At Shinhan Bank, the attacker reportedly accessed a loan progress inquiry service used by financial brokers.
At Kookmin Bank, an internal mobile work support system for employees was reportedly compromised.
These systems may not have the same security visibility or defensive investment as core banking platforms, but they can still contain sensitive information.
This creates a critical security principle for financial institutions:
Every connected application can become part of the financial organization’s attack surface.
Security programs therefore need to consider more than internet banking and payment infrastructure.
They should also cover:
• Broker portals
• Loan processing systems
• Employee applications
• Customer support platforms
• APIs
• Mobile applications
• Third party integrations
• Administrative portals
• Internal business applications
• Cloud services
Sensitive Data Can Exist Outside Core Systems
Attackers often look for the path of least resistance.
A supporting application may contain fewer records than a central banking platform, but the information can still be valuable.
Customer identifiers, employee information, loan details, contact information, account related records, and internal business information can all have financial or operational value.
The reported campaign allegedly involved attempts to identify valid customer numbers through a loan related service before collecting associated information.
This illustrates why data protection cannot be limited to databases considered mission critical.
Organizations should understand where sensitive information exists across the entire application ecosystem.
AI Changes the Speed of the Attack Lifecycle
Cybersecurity teams already struggle with the speed of modern attacks.
AI can increase that pressure.
A threat actor may use AI to move quickly between activities that previously required significant manual effort.
For example, an attacker could use automation to analyze large amounts of information, prioritize potential weaknesses, generate supporting code, document findings, and coordinate activity across multiple targets.
This creates a growing gap between:
Attack speed
and
Defensive response speed
Security operations teams must therefore improve their ability to detect suspicious behavior early rather than relying exclusively on investigating incidents after sensitive data has already been accessed.
The Rise of Agentic Security Tools Creates a Dual Use Challenge
AI powered penetration testing tools are not inherently malicious.
Security professionals can use automated security tools to:
• Identify vulnerabilities
• Test applications
• Validate security controls
• Discover misconfigurations
• Prioritize weaknesses
• Validate remediation
• Improve penetration testing efficiency
The challenge is determining whether these capabilities are being used within an authorized security assessment or against systems without permission.
This makes governance increasingly important.
Organizations developing or deploying AI security tools should establish clear controls around:
• Authorized targets
• User identity
• Scope of testing
• Access permissions
• API usage
• Tool capabilities
• Logging
• Data handling
• Human oversight
• Incident response
AI security tools should be powerful enough to help defenders while remaining governed by clear authorization boundaries.
Financial Institutions Face a Unique Risk
Financial organizations are attractive targets because they combine valuable information with highly interconnected digital infrastructure.
Banks and financial companies commonly operate large ecosystems involving:
• Customer applications
• Payment systems
• Loan platforms
• Broker systems
• Mobile applications
• APIs
• Cloud services
• Third party providers
• Employee systems
• Identity platforms
A weakness in one connected application can potentially create a pathway toward sensitive information or additional systems.
Financial organizations therefore need an attack surface management approach that considers the entire ecosystem rather than focusing only on the most visible applications.
Identity Security Becomes Critical
AI assisted attacks can make identity compromise even more dangerous.
If an attacker obtains valid credentials, compromised access may appear similar to legitimate activity.
Security teams should therefore monitor:
• Unusual login patterns
• New device registrations
• Abnormal geographic activity
• Suspicious API access
• Unusual session behavior
• Privilege changes
• Large data queries
• Automated requests
• Unexpected application access
Strong authentication should also be combined with continuous behavioral monitoring.
Multi factor authentication, phishing resistant authentication, privileged access management, conditional access, and least privilege can significantly reduce the potential impact of compromised identities.
APIs and Automated Requests Need Greater Visibility
Modern financial services depend heavily on APIs.
APIs connect applications, partners, mobile services, internal platforms, and third party systems.
However, APIs can also become attractive targets when they expose sensitive functions or data.
Organizations should monitor API activity for:
• Excessive requests
• Unusual query patterns
• Automated enumeration attempts
• Unexpected geographic sources
• Abnormal authentication behavior
• Unusual access to customer records
• Requests outside normal business patterns
Rate limiting, authorization controls, input validation, API gateways, logging, and behavioral analytics should be part of a mature API security strategy.
Third Party and Supporting Applications Cannot Be Overlooked
The reported campaign also reinforces the importance of third party risk management.
Financial institutions increasingly depend on vendors, fintech providers, cloud platforms, brokers, technology partners, software providers, and external service organizations.
A security weakness within one of these environments can potentially affect the broader ecosystem.
Organizations should therefore evaluate:
• Vendor access
• Third party APIs
• Cloud integrations
• Authentication mechanisms
• Data sharing
• Security monitoring
• Vulnerability management
• Incident notification procedures
• Privileged access
• Software supply chain risks
Third party risk should be continuously evaluated rather than treated as an annual compliance exercise.
AI Assisted Attacks Require AI Aware Defense
Organizations do not necessarily need to respond to AI enabled attacks by simply purchasing another AI product.
The more important requirement is to understand how AI changes attacker behavior.
Security teams should ask:
Can our monitoring identify highly automated reconnaissance?
Can we detect abnormal API activity quickly?
Can we distinguish legitimate automation from malicious automation?
Can we identify unusual access to sensitive records?
Can we correlate activity across identity, endpoint, application, and network telemetry?
Can we investigate an incident quickly enough to match the speed of an automated attacker?
These questions should become part of modern security operations.
What Organizations Should Do Now
1. Expand Attack Surface Visibility
Maintain an inventory of internet facing applications, internal applications, APIs, cloud resources, mobile systems, and third party integrations.
2. Protect Supporting Applications
Do not assume that an application is low risk simply because it does not directly operate the core banking platform.
3. Strengthen API Security
Test APIs for authentication, authorization, excessive data exposure, abuse, enumeration, and other application security weaknesses.
4. Implement Strong Identity Controls
Use phishing resistant authentication, least privilege, privileged access management, and continuous identity monitoring.
5. Monitor Automated Behavior
Develop detection capabilities for unusual automated requests, abnormal record lookups, unexpected scanning patterns, and suspicious data access.
6. Conduct Regular Penetration Testing
Security testing should include customer portals, employee applications, APIs, mobile applications, cloud environments, and third party integrations.
7. Protect Sensitive Data
Apply data classification, access controls, encryption, monitoring, and data loss prevention across applications and databases.
8. Improve Incident Response
Security teams should have predefined procedures for compromised applications, stolen credentials, suspicious data access, and potential customer data exposure.
9. Assess AI Related Risks
Organizations should evaluate how AI tools are being used internally and how AI can change the threat model affecting their applications.
10. Combine Automation With Human Oversight
AI can accelerate security operations, but critical decisions should remain subject to appropriate validation, governance, and accountability.
Industries That Should Pay Attention
Although the reported campaign focused on South Korean financial organizations, the underlying security lessons apply across multiple industries.
Financial Services and Banking
Banks, fintech companies, lending organizations, investment firms, payment providers, and insurance companies should strengthen protection for customer applications, APIs, identity systems, financial data, and connected services.
Healthcare and Life Sciences
Healthcare organizations should protect patient portals, employee systems, APIs, third party applications, and sensitive health information from automated attacks and data theft.
Retail and E-commerce
Retail organizations increasingly depend on APIs, mobile applications, payment systems, customer portals, and cloud platforms that can become targets for automated attacks.
Manufacturing and Industrial Organizations
Manufacturers should protect enterprise applications, connected infrastructure, cloud systems, supplier platforms, and operational technology from increasingly automated threats.
Government and Public Sector
Government organizations should strengthen security across citizen services, administrative platforms, APIs, cloud environments, and sensitive databases.
Technology and SaaS Companies
Technology providers and SaaS companies should assess AI related threats across applications, APIs, cloud environments, source code, customer platforms, and software supply chains.
The Bigger Cybersecurity Lesson
The South Korean financial sector campaign demonstrates a broader transformation in cybersecurity.
The barrier to conducting sophisticated cyber activity may be decreasing as AI tools become more accessible.
This does not mean every attacker will suddenly become highly capable.
It does mean that security teams need to assume attackers can automate more of the work than they could in the past.
Defenders should therefore focus on reducing the time required to identify suspicious behavior, investigate anomalies, contain compromised systems, and protect sensitive information.
The goal is not simply to deploy more technology.
The goal is to build a security architecture capable of operating at the same speed as an increasingly automated threat landscape.
Conclusion
The reported breaches involving South Korean financial organizations are an important warning about the changing economics of cyberattacks.
A single operator using publicly available AI capabilities and automated security tools can potentially investigate multiple targets, accelerate technical tasks, and pursue sensitive information at a scale that would previously have required considerably more manual effort.
The defensive response must therefore extend beyond protecting core systems.
Organizations need visibility across applications, APIs, identities, cloud environments, third party services, employee systems, and sensitive data.
For financial institutions in particular, supporting applications and connected services must receive the same level of security attention as core banking infrastructure.
AI can become a powerful defensive capability, but organizations must also prepare for AI assisted threats by strengthening identity security, application security, API protection, vulnerability management, threat detection, penetration testing, data protection, and incident response.
The future of cybersecurity will increasingly be defined by how effectively organizations can combine automation, intelligence, governance, and human expertise to defend against automated adversaries.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services
• Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
In addition, COE Security helps organizations address the growing risks associated with AI assisted cyberattacks through AI security assessments, application security testing, API security testing, vulnerability assessments, penetration testing, threat detection, identity and access management reviews, cloud security assessments, software supply chain assessments, data protection programs, and continuous security monitoring.
For financial services and banking organizations, COE Security helps assess customer portals, loan and lending applications, broker platforms, APIs, mobile applications, employee systems, cloud environments, identity controls, and financial data workflows. We help organizations identify security gaps, strengthen authentication, detect abnormal activity, and improve incident response readiness.
For healthcare and life sciences organizations, we help protect patient portals, sensitive information, APIs, cloud environments, employee applications, and third party integrations through security assessments, vulnerability management, data governance, penetration testing, and compliance aligned security programs.
For retail and e-commerce organizations, we help secure customer facing applications, payment environments, APIs, mobile applications, digital accounts, cloud infrastructure, and customer data against automated attacks and emerging AI enabled threats.
For manufacturing and industrial organizations, COE Security supports application security, cloud security, identity protection, connected infrastructure assessments, vulnerability management, penetration testing, and security monitoring across enterprise and operational environments.
For government and public sector organizations, we help strengthen public facing applications, citizen services, APIs, cloud platforms, identity systems, sensitive databases, vulnerability management, threat detection, and compliance programs.
For technology and SaaS organizations, we help evaluate applications, APIs, cloud infrastructure, development platforms, source code, third party dependencies, and AI enabled systems through penetration testing, secure development consulting, software supply chain assessments, and continuous security monitoring.
COE Security also helps organizations evaluate emerging AI security risks, including AI assisted cyberattacks, prompt injection, excessive AI permissions, insecure AI integrations, AI enabled reconnaissance, automated data access, and AI driven threat activity.
Our goal is to help organizations identify security gaps, reduce cyber risk, strengthen resilience, protect sensitive information, and maintain compliance as AI becomes increasingly integrated into cybersecurity and business operations.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption and to stay updated and cyber safe.
Click to read our LinkedIn feature article