SEOUL – In an operation marking a watershed in the history of cybersecurity, South Korean authorities have dismantled a criminal organisation responsible for breaching more than 90 national infrastructures. The operation culminates in what the Seoul Metropolitan Police Agency has confirmed as the first official arrest of a suspect for directly using generative Artificial Intelligence to carry out large-scale cyberattacks and data theft.
The main suspect, currently in custody, is a self-taught 32-year-old hacker who previously worked as a penetration tester for a cybersecurity company between 2019 and 2022. Drawing on his existing skills, the man initially launched an attack campaign in September 2025 using conventional methods. The technological turning point and the organisation’s escalation came in August 2026, when the group adopted ARTEX AI, an advanced autonomous penetration testing framework already known to authorities for its recent use by cybercriminals against several South Korean banks.
Adopting this artificial intelligence enabled the group to automate and expand its intrusions with unprecedented reach. The breaches resulted in the theft of 8.2 million personal and corporate data records from a wide range of organisations, including hospitals, educational institutions, large corporations and even recreational facilities. In at least 38 confirmed instances, the criminals attempted to extort ransom payments totalling 360 million won (approximately US$270,000), threatening to disclose sensitive information.
The investigation, triggered by a victim’s complaint in June, led to the identification of seven suspects. While the group’s leader, arrested on 15 October and formally detained two days later, has been referred to prosecutors, the other six members remain under investigation without detention. To identify the perpetrators, law enforcement analysed logs from the compromised servers, using an in-house AI-based analytical tool of their own.
South Korean police have highlighted the historic and alarming significance of the operation. This first arrest for AI-enabled cyberattacks demonstrates how new technologies are lowering the barriers to entry into cybercrime. AI frameworks are enabling individual actors to orchestrate highly sophisticated threats previously confined to highly organised hacking collectives. Investigations remain ongoing to establish whether the stolen data has already been sold or distributed on dark web markets.
Sources and documents
Document date or reference period: Original contribution provided to the newsroom · 27 October 2026.
Signed contribution by Gerardo Costabile, provided to the newsroom. Original text with editorial formatting only. The reference to the first arrest concerns the South Korean case described by authorities in the sources below.
