What changed
Logpresso said AI-backed attacks on seven South Korean financial institutions may be linked to Vitas, a Chinese group known for carrying out DDoS attacks for hire.
The firm connected the Telegram account “YY520CN” and records from the GodNet online community to the attacks through stolen infostealer data, GitHub code and cloud records. South Korean investigators suspect the attackers used several AI models, including DeepSeek and ARTEX, but the links do not identify the operator or prove that Vitas carried out the hacks.
Why it matters
The striking development is not simply that AI appeared in the attacks. It is that investigators are tracing the operation through the scattered debris of modern online crime: a Telegram identity, edited GitHub code, stolen passwords and cloud-service records.
Logpresso found that the stolen data included Microsoft and Oracle cloud login details. That suggests the suspected GodNet member may have had access to technical systems supporting the group, although that person has not been directly linked to the bank attacks.
The trail is also becoming harder to pin down. The YY520CN account was deleted on Oct. 8, then reappeared under the same username with a denial of involvement. It is unclear whether the replacement account has the same controller. The phone-number holder linked to the account also denied involvement, saying the number had been used without permission.
ARTEX’s developer stopped public updates after the tool was reportedly misused. That response shows the practical problem facing makers of powerful security tools: once an agent can automate parts of penetration testing, separating legitimate testing from criminal use becomes much harder.
The immediate outlook is investigative rather than conclusive. If cloud-provider records can be matched to the stolen login data, investigators may be able to identify people behind the GodNet accounts and clarify whether the same network was involved in the attacks on the seven institutions.
Comments
No comments yet.