TAG-217 used AI-assisted ARTEX framework against South Korean banks, with crypto-theft, Linux and mobile tooling found as early as August 2026
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…