TAG-217 Targets South Korean Financial Services with ARTEX​​

Recorded Future has published a report on a threat actor it designates TAG-217, stating that by 26 September the actor's working environment contained AI tools and records referencing reconnaissance, network traffic proxying, payload delivery and examination of payment processes against South Korean financial institutions. The findings were published on Recorded Future's website. The records described in the excerpt concern South Korean financial institutions as the targets of the activity.

According to the excerpt, the actor used a Chinese-language, open-source AI penetration testing framework. The excerpt gives no name for the framework. Recorded Future states that the variety of targets suggests the ability to opportunistically test for weaknesses at scale. The excerpt lists four categories of activity found in the working environment: reconnaissance, network traffic proxying, payload delivery, and examination of payment processes.

The excerpt does not name the South Korean financial institutions involved, does not state whether any intrusion succeeded, and does not identify a state sponsor behind TAG-217. It describes records held in the actor's working environment rather than a confirmed compromise of a named bank. Recorded Future's stated conclusion is that the variety of targets indicates a capability to test for weaknesses opportunistically at scale, rather than a campaign concentrated on one institution. The excerpt addresses the actor's tooling and recorded activity; it gives no figures for affected institutions, data volume or financial loss.