AI-powered attacks on South Korean financial sectors linked to Chinese DDoS group: Report

Logpresso's findings trace connections through digital evidence, including a Telegram account that moderated an online community created by Vitas. Further analysis of GitHub code linked to another GodNet member revealed an email address associated with login details stolen by infostealer malware in 2023. This compromise exposed credentials for Microsoft and Oracle cloud services, suggesting the member might have managed the group's technical systems.

While these links establish a potential organizational connection, Logpresso noted that the account links alone do not confirm who precisely carried out the hacks or if a single individual was responsible. The operator of the "YY520CN" account remains unidentified, with the account deleted and a new one denying involvement. This highlights the inherent challenges in definitive attribution, even with detailed forensic analysis.

The alleged use of multiple AI models, such as DeepSeek, alongside a specialized AI-powered penetration-testing tool like ARTEX, points to an evolving sophistication in cyberattack methodologies. The developer of ARTEX subsequently halted public distribution due to its misuse, underscoring the dual-use nature of advanced AI tools. This trend suggests that the increasing availability of powerful AI capabilities could lead to more complex and evasive cyber threats.