A criminal network organized around a repurposed pentesting tool

A group of seven individuals, including a 32-year-old former pentester, orchestrated a cyberattack campaign in South Korea between September 2025 and October 2026, according to BleepingComputer and Yahoo News. The leader, who worked in a cybersecurity firm between 2019 and 2022, used the ARTEX AI tool, designed for intrusion testing, to automate large-scale attacks. Targets included hospitals, universities, private schools, golf courses, and subsidiaries of major conglomerates, including a funeral services provider that lost 1.22 million records, including data on minors.

Even people who are not professional hacker organizations can now carry out large-scale hacking with the help of AI.

Innovative methods: AI as an accelerator for attacks

The group began operations in September 2025 before integrating generative AI tools from late August 2026, significantly reducing the time needed to carry out mass intrusions, according to the Seoul Metropolitan Police. The ARTEX AI tool automated key steps, such as identifying vulnerabilities or generating malicious payloads. Korean authorities emphasize that this case represents the first instance in the country where a large-scale campaign was AI-assisted, with ransom demands totaling 360 million won (approximately 270,000 dollars) across 38 incidents.

Investigators traced the attacks through server logs after a victim filed a complaint in June 2026. They also used an internal AI-based tool to analyze the recovered evidence, confirming that the stolen data had not yet been published on the dark web, according to BleepingComputer.

An unexpected profile: the self-taught individual and the accessibility of criminal tools

Unlike traditional hacker groups, the network’s leader had no formal computer science training. He learned through YouTube tutorials and online blogs, as reported by Yahoo News. This case illustrates how individuals without advanced technical skills can now exploit tools like ARTEX AI or generative AI models (such as Claude Code, mentioned by Anthropic in August 2025) to carry out sophisticated cyberattacks. South Korean police stress this shift: « Even people who are not professional hacker organizations can now carry out large-scale hacking with the help of AI, » declares a spokesperson.

What this changes here: increased risks for Beninese and West African organizations

This case highlights several potential threats to businesses and government agencies in West Africa, where digitalization is accelerating without always being accompanied by strengthened cyber defenses. First, the automation of attacks: tools like ARTEX AI, designed for legitimate testing, could be repurposed by cybercriminals to target common vulnerabilities in local infrastructure, such as data management systems or online payment platforms. Next, the democratization of skills: self-taught individuals, trained through accessible resources (tutorials, forums), could replicate these methods, as demonstrated by the use of Claude Code by Chinese groups according to Anthropic.

Finally, pressure on sensitive data: the South Korean targets included institutions handling information on minors, a particularly critical risk for schools, hospitals, and public services in Benin, where personal databases are often underprotected. The ransoms demanded (up to $270,000) could also encourage local groups to replicate this model, especially as incident response capabilities remain limited in the region.