Recorded Future's Insikt Group published research on 16 October expanding the known timeline and capability of TAG-217, the actor behind AI-assisted attacks on South Korean financial institutions. Public reporting indicated the breaches exposed personal data belonging to at least 68,000 people across at least seven financial institutions, disclosed by South Korea's Financial Services Commission in early October. Insikt Group found the actor testing infrastructure and assembling attack tooling as early as August 2026 — weeks before the banking campaign became public — including tools designed to steal cryptocurrency wallet files, gain deeper access to Linux systems and test weaknesses in mobile devices. The researchers characterise the case as the "jagged edge" of AI-enabled attacks: AI lets the actor pursue more targets across more environments but does not prevent the operational-security mistakes that exposed its preparations. For Australian and New Zealand financial-sector defenders, the practical lesson is that AI-assisted campaigns still leak infrastructure and tradecraft, so hunting on those mistakes remains viable.

• Source article