Hackers targeting Korean financial sector, circumstances behind Chinese DDoS agency organization

Domestic security company Logpresso discloses information collection and cross-analysis results

Financial hacking suspect 'YY520CN', traces of DDoS organization supervisor activity

(Seoul = Yonhap News) Reporter Hayoung Kwon = The possibility has been raised that the person identified as the mastermind behind the hacking attack targeting the domestic financial sector is a member of a Chinese DDoS (distributed denial of service) agency.

According to the results of 'Additional Analysis of the ARTEX Campaign - Verification of the Attack Group' published by domestic security company Logpresso on the 9th, the US security company CrowdStrike confirmed that a specific suspect was active in the Chinese DDoS agency hacking organization 'GodNet and VITAS'.

Previously, CrowdStrike analyzed that in attacks targeting Korean financial institutions from late last month to early this month, attackers used Chinese artificial intelligence (AI) penetration testing tool 'ARTEX' and AI models such as DeepSeek.

In addition, it was revealed that personal information such as name initials, Telegram account, and residence were exposed when the attacker requested a security researcher's resume using the AI ​​coding tool 'Claude Code', raising the possibility that he was a 26-year-old person living in Guangdong Province, China.

However, the Chinese suspect identified at the time, 'YY520CN', reportedly stated that his mobile phone number had been stolen and that he had nothing to do with the hacking.

Logpresso obtained additional clues by cross-analyzing authentication information leaked to Telegram, GitHub, and the dark web, and the analysis revealed that the YY520CN account was active in the position of 'community supervisor', which manages members in the Godnet and Vitas organizations.

Godnet and Vitas are Chinese hacking organizations that carry out DDoS attacks. It was discovered that they operated a community on Telegram called ‘Sangje Society’ and divided the organization into top administrators, community managers, supervisors, applicants, advertisers, etc.

The 'HangHang2017' account, a member of the same organization, was found to have been infected with 'Inpostealer', a malware that secretly steals website login information from terminals in 2023, leaving numerous traces.

Logpresso said that based on this information, it had secured the email address and domain associated with the HangHang2017 account. The explanation is that related indicators were found by sequentially comparing GitHub commits (records) that record the developer's source code modification history, the Telegram organization member list, and authentication information leaked through Infostealer (malware).

By comparing the email and domain information obtained in this way with the cloud provider's subscription information, the actual operator of the HangHang2017 account can be confirmed, and it is expected that the identity of YY520CN can be cross-verified using this as a starting point.

Logpresso advised that all systems that can be accessed from outside, even if they are not customer services, should be included in the inspection target. He added that it is necessary to check whether the viewing permissions after logging in are properly set and whether abnormally repeated viewing behavior is detected.