Science & Tech · Cybersecurity · 21 hrs ago
South Korean bank attacks may be linked to Chinese DDoS group
Seven South Korean financial institutions were targeted in a series of cyberattacks.
Investigators suspect the attacker used several AI models and a Chinese-made penetration-testing tool.
A Seoul cybersecurity firm found that a Telegram account linked to the attacks had been listed as a moderator in an online community created by Vitas, a Chinese group that carries out DDoS attacks for paying clients.
DDoS attacks flood online services with traffic to make them unavailable.
The firm also traced another community member’s accounts through login details stolen by malware, but did not directly link that person to the bank attacks.
These account links do not prove who carried out the attacks, and the identity of the Telegram account’s operator remains unclear.
South Korean authorities are investigating, while the tool’s developer has said it will stop updates and public distribution after reports of misuse.
A Seoul-based cybersecurity firm said South Korean bank attacks may be linked to accounts associated with GodNet, a Chinese DDoS-for-hire community.
Logpresso said the account links do not establish who carried out the hacks, and it could not conclude that only one person was involved.
The identity of the operator of the Telegram account YY520CN remains unclear, and the owner of its linked phone number denied involvement.
South Korean authorities suspect the attacker used multiple AI models, including DeepSeek, with a Chinese-made AI penetration-testing tool.
The reported attacks targeted seven South Korean financial institutions in succession.
- Who
- South Korean banks were targeted. Investigators suspect an attacker whose identity remains unclear.
- What
- A series of AI-backed cyberattacks targeted financial institutions; researchers said accounts linked to the attacks may have ties to GodNet.
- When
- The report was released on Oct. 11, 2026. The attacks were described as recent.
- Where
- South Korea; the attacks reportedly used Hong Kong-based control servers.
- Why
- Not stated
Logpresso and South Korean investigators
YY520CN account's operator and the linked phone-number owner
Alleged involvement
Logpresso and South Korean investigators
Logpresso found links between accounts associated with the bank hacks and GodNet, but said the links do not prove who carried out the attacks.
YY520CN account's operator and the linked phone-number owner
The phone-number owner denied involvement and said someone had used their number without permission.
Certainty about identity
Logpresso and South Korean investigators
The identity of the YY520CN operator remains unclear, and Logpresso could not conclude that only one person was behind the breaches.
YY520CN account's operator and the linked phone-number owner
It remains unclear whether the original YY520CN account and a later account using the same username had the same operator.
someone had used their number without permission
YY520CN was listed as a moderator of GodNet, according to Logpresso.
Login details traced to a second GodNet member had been stolen by infostealer malware.
CrowdStrike released a report that Logpresso later analyzed.
The YY520CN Telegram account was deleted after the CrowdStrike report was released.
Logpresso released its report on possible links between the bank attacks and GodNet.
- Target institutions
- Seven South Korean financial institutions
- Telegram account
- YY520CN
- Online community
- GodNet
- DDoS group that created GodNet
- Vitas
- Suspected AI tool
- ARTEX
- Control-server location
- Hong Kong
Sources
Related news
AI security patches often stop crashes but fail maintainers’ tests
Phone settings can help block spam calls and scam texts
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
US seizes two China-linked hacking tools used against critical infrastructure
Dropbox launches data access governance tool in Singapore
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Canadian cybersecurity executive arrested on extortion-related charges
Canadian cybersecurity executive arrested in U.S. hacking case
New characters let lookalike domains bypass some browser checks
