South Korean authorities have arrested a cyberhacking gang, reportedly led by a self-taught individual who utilized artificial intelligence to breach the systems of approximately 60 companies. Despite demanding substantial sums from victims, the group allegedly managed to extort only 300,000 Won, approximately $210 USD, according to reports from Yonhap News Agency, Seoul Economic Daily, and The Chosun Daily.
The gang is accused of accessing sensitive customer data, including names, registration numbers, phone numbers, and addresses, from over 90 firms in total. Their alleged method involved a combination of AI-assisted coding and an autonomous penetration testing system. Threatening emails were sent to affected companies, warning of reputational damage and potential government fines if the breaches were made public.
Crucially, payment information was not compromised in these breaches, and South Korean police have stated that the stolen data has not yet appeared on the dark web. The swift action by law enforcement is credited with limiting the financial success of the operation. Police received a complaint in June, with the investigation commencing in August, leading to the arrest of seven individuals, including the alleged 32-year-old ringleader, between July and September.
Adding to the intrigue, the alleged leader reportedly had no formal IT background, having studied arts and physical education. Their hacking knowledge was reportedly acquired through online resources such as YouTube. Authorities believe the group may have practiced their techniques through simulated hacking exercises at a security firm between 2019 and 2022.
While 38 of the targeted firms reportedly suffered losses, a total monetary figure for these damages has not been disclosed. The incident highlights a growing concern regarding the use of AI in criminal activities. Google previously identified AI as a tool being leveraged by threat actors to enhance the efficiency of their attacks. The relatively small payout in this case suggests that while AI may streamline cybercrime, it does not guarantee substantial financial gains, especially when met with effective law enforcement.
