Loading threat actor…
TAG-217 is a threat actor tracked by Recorded Future’s Insikt Group and associated with AI-assisted intrusions against South Korean financial institutions. Its preparations date to at least August 2026. Breaches disclosed in October 2026 affected at least seven financial institutions and exposed personal information belonging to at least 68,000 people, including customer data and an outsourced developer’s personal information. Its country of origin and organizational affiliation have not been established. TAG-217 combines AI-assisted penetration-testing tools with conventional intrusion techniques. Its operational environment included ARTEX and other AI services supporting reconnaissance, network traffic proxying, payload delivery, and examination of payment processes. The actor conducted internet scanning, tested remote-access infrastructure, and prepared residential proxy routing to conceal its traffic. Operational security failures, including exposed directories, revealed its infrastructure and tooling. The extent to which AI accelerated its attacks has not been established. Beyond the financial-sector intrusions, TAG-217 assembled tools targeting cryptocurrency mining operations using the YiiMP platform. These tools could attempt default passwords, steal cryptocurrency wallet configuration and key material, maintain remote access, and notify operators when credentials were captured. Additional Linux tooling supported privilege escalation and extraction of protected password data after initial access. The actor also maintained an environment for testing iPhone exploitation techniques and modifying Android system software, although successful mobile compromise was not demonstrated. Early remote-access infrastructure tests likewise did not establish successful access to victim systems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TAG-217 is linked to AI-assisted attacks against South Korean financial institutions that reportedly exposed personal data belonging to at least 68,000 people across at least seven institutions. The actor was testing infrastructure and assembling tools as early as August 2026, before the campaign became public in October. Researchers uncovered preparations involving cryptocurrency wallet theft, expanded access to Linux systems, and mobile-device security testing. The actor is suspected to be Chinese-speaking, but the content does not establish its country of origin or state sponsorship.
An opportunistic, financially motivated activity cluster combining AI services with established attack tools. Exposed infrastructure revealed activity beginning August 17, 2026, including internet scanning, remote-access testing, preparation to attack YiiMP cryptocurrency mining operations, Linux exploitation tooling, and mobile exploitation experiments. The content also associates TAG-217 with attacks on South Korean financial services. The identified remote-access and mobile-testing logs did not demonstrate successful victim compromise, and the evidence does not establish how much AI accelerated its operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.