Cyberattacks target financial institutions in South Korea and Brazil

Cybersecurity investigations have revealed distinct hacking campaigns targeting financial institutions in South Korea and Brazil, highlighting the evolving use of advanced tools by threat actors.

In South Korea, hackers associated with the group TAG-217 utilized artificial intelligence tools, including Claude Code, DeepSeek, Grok, and Zhipu AI, alongside the ARTEX open-source framework. These attacks targeted at least seven financial institutions, reportedly exposing the personal information of approximately 68,000 individuals. Researchers from Recorded Future’s Insikt Group noted that the group, suspected to be Chinese-speaking, used these tools to seek vulnerabilities, steal cryptocurrency wallet files, and test mobile devices.

Separately, a group identified as Slim Spider targeted a Brazilian financial institution in late March 2026. According to a CrowdStrike investigation, the attackers used custom scripts to obtain temporary cloud service credentials and accessed software development environments. The hackers deployed tools designed to map financial services and prepare for mass unauthorized Pix transfers. While the investigation identified tools capable of automating large-scale transfers, it has not confirmed that any fraudulent transactions were successfully completed or resulted in direct financial losses.