AboutStealthCastleProofAEGISSolutionsCompanyVideosContact

Stealth Moving Target Defense

Defending against AI‑automated hacking
active defense is the answer

"The proven secret weapon" StealthCastle (SMTD)

Videos Contact us
≤1sHow often the address changes
0Successful attacks · bank's simulated AI hack

Chapter 1 · The attacks have begun

AI-automated hacking: the attacks have already begun

In September–October 2026, attacks using an automated AI hacking program (ARTEX)
breached seven Korean financial companies

1.1 · Scale of damage

Financial companies hacked

7

Banks, savings banks, capital firms

Leaked data

68K

About 66,000–70,000 people depending on the count date

Core banking systems (the systems that run accounts and transactions) were untouched — this time, only entry points visible on the internet were breached

Sources Financial News 2026-10-04·10-07; Herald Economy 2026-10-03

1.2 · ARTEX

What the AI (ARTEX) did — from automatically finding targets (reconnaissance) to mass queries

  1. Find targetsSearch the internet for exposed addresses and services StealthCastle cuts this
  2. BypassPick the least protected entry point StealthCastle cuts this
  3. Password reuseTry leaked usernames and passwords over and over (credential stuffing) StealthCastle cuts this
  4. Avoid detectionSwitch internet addresses (IPs) and try a little at a time StealthCastle cuts this
  5. Mass queriesPull data out through ordinary lookups with legitimate access, without taking over systems Not cut — detection and audit

StealthCastle cuts steps ①–④; step ⑤ (mass lookups with legitimate access) is stopped by detection and audit

Sources · notes

Note ARTEX: a freely available program that links outside AI language models (LLMs) such as DeepSeek to hack automatically (confirmed by the Financial Security Institute)

Sources Financial-sector active security proposal (2026-10); Herald Economy 2026-10-03; Money Today 2026-10-02

1.3 · Recent cases abroad

The same thing keeps happening abroad

  • France

    Supermarket fridges hacked at once

    Attackers got in through an internet-connected remote management system and pushed fridge temperatures in some 400 stores up to 50°C — fresh food thrown away, fires at some stores, losses in the tens of millions of euros (as reported)

    Exposed entry pointUnsupported legacy equipment

  • Netherlands

    Security non-profit breached by an AI agent

    An AI agent chained two previously unknown flaws (zero-days) in an internet-facing customer-support system, broke in and took some data (according to the victim, DIVD)

    Exposed entry pointAutonomous AI attack

  • United States

    AI under testing breaks into public sites

    AI models being tested exploited a flaw to run commands on a university server and got around access limits on government sites — the developer said real-world impact was minimal and cut the tests off from the internet

    Exposed entry pointAI found its own way around

What they share: the entry points visible from outside are breached first — which is why the attack surface must be hidden

Sources · notes

Note Reported store counts in France vary (150 to about 400). In the Dutch case, "AI agent" is the victim's own assessment; the attacker has not been identified. The U.S. case is a testing incident disclosed by the AI developer itself (Anthropic).

Sources BleepingComputer 2026-10-12 · Seoul Shinmun 2026-10-13 (citing BBC and Reuters) · BleepingComputer 2026-09-29 · BleepingComputer 2026-09-30 (DIVD follow-up) · Anthropic 2026-10-09 · BleepingComputer 2026-10-12

Chapter 2 · Why it is dangerous

Why is AI-automated hacking dangerous?

AI did not attack with new techniques.
It simply attacked cheaper, faster and more often

2.1 · Speed and scale

Hacking work done by AI

80–90%

People made only 4–6 key decisions

Reproduced by a non-expert

6min

A freely available AI model and one graphics card (GPU)

Fastest spread inside a network

27s

Faster than people can watch and respond

A dangerous world where anyone can hack easily, with AI, around the clock

Sources Anthropic threat report 2025-11-13; ZDNet Korea 2026-10-06 (Soongsil Univ. simulation); CrowdStrike 2026 Global Threat Report

2.2 · Limits of conventional security

Building higher walls cannot stop it

Firewalls · intrusion detection (IDS)Detect, then block — after the fact
  • Blocks only after an intrusion is confirmed
  • Small attempts that stay under the alarm threshold get through
Fixed network addresses (IPs and ports)The map is public
  • Addresses never change, so the entry points hackers have found stay exposed
  • Some financial firms only noticed after being sent the attackers' addresses

A commercial solution that stops attackers from finding targets (reconnaissance) in the first place is hard to find anywhere in the world

Sources · notes

Note Based on public sources (2026-10)

Sources Financial-sector active security proposal (2026-10); New Daily 2026-10-08; Zscaler 10-K FY2026; morphisec.com; NIST SP 800-160 Vol.2 Rev.1

Chapter 3 · The secret weapon

Defending against AI-automated hacking:
why is StealthCastle (SMTD) the "secret weapon"?

It applies to entry points where an agent is installed — staff, partners and loan brokers — and to customer apps with the MTD library built in.

3.2 · Edge ①

StealthCastle edge ①
The address changes every second.(network addresses change in front of the servers being protected)

Conventional security — static targetThe address stays the same
  • An address (IP/port) found once keeps working
StealthCastle — moving targetThe address keeps changing
  • Addresses change as often as every second
Sources · notes

Note 1/4.2B is the theoretical number of combinations (IP × port × network) — the real figure depends on the customer's actual IP ranges and ports.

Note Addresses change only on the outside of the StealthCastle device (gateway) — the servers behind it keep their addresses and firewall settings stay the same

Source Company and technology overview (2026-10)

3.3 · Edge ②

StealthCastle edge ②
It trusts no one(Zero Trust through 5-Factor authentication)

Five checks (5-Factor) verified together in the core of the operating system (kernel)

PIDThe running program
SessionThe current connection
App infoWhether the app was tampered with
UserUser authentication
DeviceDevice authentication

The 5-Factor checks confirm "this program is genuine", and unapproved programs on infected devices are cut off

Sources · notes

Note Zero Trust: a security approach that trusts no person or device by default — not even inside the company — and checks every connection

Source Company and technology overview (2026-10)

3.4 · Edge ③

StealthCastle edge ③
Bulkheads inside the castle(micro-segmentation: splitting the network into small pieces by connecting only app to app)

Conventional network segmentsInside a segment, everything is open
  • Hosts in the same segment talk freely
  • One breached computer spreads to the next (lateral movement)
App to AppOnly approved apps are connected
  • Several private, changing channels only between approved apps
  • Stops attacks from spreading · added on top of factory and equipment networks (OT) without downtime

Suspicious access is lured to a decoy server so the attack can be recorded and analyzed (optional)

Sources Company and technology overview (2026-10); Seoul Metropolitan Government active security proposal §3.2 (2026-09-11)

3.5 · Deployment

StealthCastle is easy to install and use

No added load on systems, no added inconvenience for users.

A true "overlay" (added on top)It sits on top of existing systems as they are
  • No changes to servers, firewalls or addresses
  • Rolled out step by step without stopping service — expanded after measuring each part
Almost no "overhead" (extra load)Users notice no change after installation
  • 40 GB transfer time identical before and after address changes (3,634 s) — 0% delay (internal check during a certification test by KOIST, a security testing lab · throughput basis — connection set-up latency (p50/p99) to be measured separately)
  • Seoul CCTV pilot — no video delay or performance loss

Sources Company and technology overview (2026-10); Seoul Metropolitan Government active security proposal §4.2 (2026-09-11); KOIST certification test internal check report

3.6 · Bank proof

StealthCastle vs. AI hacking
— "proven by a bank"

A Korean bank's red team (in-house testers who play the attacker) ran a simulated AI hack with ARTEX — October 2026, right after the hacking incidents

0

Successful attacksNo successful break-in in the access records
3 rounds · over the internet · firewall left open · fixed address

RoundConditionResult
1Existing security systems + StealthCastleRecon failed · 0 successful attacks
2Existing security disabled, StealthCastle onlyRecon failed · 0 successful attacks
3Fixed IP, only the port changedRecon failed · 0 successful attacks

Source Red team penetration test 2026.10

3.7 · References

StealthCastle (SMTD), "premium security"

Deployed first by the ROK Army, Air Force and local government → expanding this year to finance, healthcare and enterprises

  1. 2021–22

    ROKAF 20th Fighter WingActive defense for video surveillance

  2. 2021–25

    ROK Army cyber battlefield networkActive defense for log-in servers

  3. 2023–24

    Seoul CCTV pilot0 addresses visible from outside

  4. 2026

    Finance (Bank OO, card company △△ and others)Contracts in progress after pilots

  5. 2026

    Healthcare (OO University Hospital)Investigating hacking traces (forensics) and security consulting

  6. 2026

    Enterprises (Group A, listed company C and others)Zero Trust project · customer data protection
New Excellent Technology (NET) · New Excellent Product (NEP) · GS Grade 1 (Korean software quality certification)U.S. patent registered (2026.9)Multiple papers accepted in SCI (leading international) journals
Sources · notes

Note Names of financial customers and Group A are withheld

Sources Company and technology overview (2026-10); Seoul proposal §4.2 (2026-09-11); IR materials; USPTO 2026.9

3.8 · United States

The U.S. cyber security vision: "active defense"

  1. 2011

    White House NSTCCore research theme of the National Science and Technology Council

  2. 2020

    NIST 800-53U.S. standards body security control SC-30(3)

  3. 2026

    NIST 800-172r3Moving target defense (MTD) requirement retained

Since the 2010s, the U.S. has set "active defense" as its cyber security vision.
Commercial vendors exist for memory mutation (Morphisec and others), but a company that has commercialized network mutation is hard to find.

Sources · notes

Note Network MTD: defense by changing network addresses. NIST lists MTD as an optional control. Memory mutation: moving where programs sit in a computer's memory

Sources NSTC 2011; NIST SP 800-53r5·800-172r3; morphisec.com

Chapter 4 · AEGIS

One more secret weapon:
AEGIS homomorphic encryption (AEGIS FHE)

Encryption that even quantum computers would struggle to break
Homomorphic encryption lets you calculate, analyze and search without decrypting.

4.1 · How it works

  1. PlaintextOriginal, unencrypted data
  2. EncryptAGCD method, resistant to quantum computers
  3. Calculate while encryptedCalculate · statistics · search
  4. Decrypt only the resultThe original is never revealed

Use data while protecting privacy (Privacy-Preserving Data Streaming)
The original data is never exposed to anyone while it is computed, analyzed or searched.

4.2 · Speed and error

'Speed' and 'error' - past the wall of homomorphic encryption

Degree-10 polynomial, measured in-house · before third-party verification

Conventional homomorphic encryption (lattice-based)Comparison baseline (in-house)
  • A complex calculation (degree-10 polynomial) 0.7997 s
  • Error on the same calculation 0.0000052
AEGIS FHEIn-house results
  • The same calculation 0.0075 s — over 100× faster than the conventional method (in-house)
  • Sum of 10,000 records matches to 25 decimal places (in-house)

AEGIS is not lattice-based: it is homomorphic encryption built on AGCD (approximate greatest common divisor).

  • Unlike lattice schemes, it has no noise.
  • Unlike lattice schemes, it needs no bootstrapping to remove noise.
  • That is why it is fundamentally faster.

* These figures are in-house measurements; the security proof, parameters and third-party cryptanalysis have not yet been published.

Chapter 5 · The best combination

Defending against AI hacking: "the best combination"

"Wrap with AEGIS, hide with StealthCastle"

5.1 · Architecture

  1. OutsideAttacker · AI agentAutomated recon · mass queries
  2. Entry points — hideStealthCastleOutside entry points: changing addresses · 5-Factor authentication · approved apps onlyInvisible — recon and intrusion blocked
  3. InsideInternal operationsLoan-broker queries · staff mobile · operational data store (ODS)
  4. Data — wrapAEGIS FHECalculate, analyze and search without decryptingNo plaintext even if breached
  5. StorageStorage · responseOnly encrypted data
Conceptual architecture — the scope of application is determined during the pilot

StealthCastle hides the entry points visible from outside, and AEGIS wraps the data so it can still be used.
Data stolen by an insider is worthless — they think they took gold, but all they see is sand.

Source Company and technology overview (2026-10)

Solution

Security solutions we also supply

Dark web intelligence · security automation · privacy security

Searchlight Cyber

CERBERUSDark web intelligence

CERBERUS gathers information from the dark web (hidden parts of the internet used for criminal trade) to help collect evidence and strengthen security. Its automated analysis of hacker forums and markets improves an organization's response to cybercrime.

  • Dark web search — explore dark web data safely and prepare for threats
  • Evidence — collect evidence on ransomware, criminal and threat groups
  • Monitoring — watch active ransomware groups and suspicious actors
D3 Security

D3 SOARSecurity automation · coordinated response

D3 SOAR is a platform that ties many security products together and handles incident response automatically (SOAR). Built on MITRE ATT&CK, a shared catalogue of hacking techniques, it gives security monitoring and response teams incident response, automation and threat information in one place.

  • Response procedures without coding (playbooks) — set up by drag and drop
  • Integrates with a wide range of security systems
  • Links scattered alerts by attack technique automatically
FRENTREE

PICPersonal data discovery and security

PIC finds personal information on Windows, macOS and Linux servers and inside database (DBMS) servers such as Oracle and Tibero, with a Korean-market web UI and a separate system for managing search results, built on experience scanning entire server fleets in the financial sector.

  • Minimal server impact — designed to use a single CPU core
  • Reads files as they are — searches directly, without conversion or decompression
  • Result management — a separate management system

Source Previous company website, SOLUTION pages (archived 2026-10-11)

Chapter 6 · Research & management

A proven research and management team

A company built on defense and public-sector deployments since 2017

6.1 · Company history

  1. 2017–18

    FoundedJoint research with ETRI (Electronics and Telecommunications Research Institute)

  2. 2019–20

    Pilots · proof of concept (PoC)Incheon Airport, KT Cloud

  3. 2021–

    Defense supplyROKAF 20th FW · ROK Army cyber battlefield network

  4. 2023–24

    Certification · publicNET·GS certified, Seoul CCTV pilot

  5. 2025–26

    NEP · U.S. patentNEP certified, U.S. patent registered (2026.9)

Stealth Solution Co., Ltd. · Co-CEOs Hyokeun Wang, Yuhan Park · Yeongdeungpo-gu, Seoul

Sources Company and technology overview (2026-10); IR materials; USPTO 2026.9

6.2 · People

"Proven careers · a growing vision" — research and management team

  • Yuhan Park, Co-CEO
    Co-CEOYuhan Park
    • Head of Strategic Planning, CHA Biotech Group
    • CEO, KBS Business
    • KBS anchor and economics editor
    • KBS Washington correspondent
    • Fellow, Duke Univ.
    • M.A. Economics, Sogang Univ.
    • B.A. Business, Seoul National Univ.
  • Hee Han, CSO
    CSO (Chief Strategy Officer)Hee Han
    • Professor, Graduate School of Information Security, Korea Univ.
    • Director, Korea Institute for Defense Analyses (KIDA); Principal Researcher, Agency for Defense Development (ADD)
    • Member, National Science and Technology Policy Committee
    • Science Advisor to six Ministers of National Defense
    • Brigade Commander, Korea Defense Intelligence Command
    • Director, Motorola Lab (T2TRC)
    • Ph.D. in Electrical Engineering
    • Korea Military Academy; Yonsei Univ.; Caltech; Yale Univ.
  • Seok-Jin Kang, Head of R&D Center
    Head of R&D CenterSeok-Jin Kang
    • Professor, Mathematical Sciences, Seoul National Univ.
    • Fellow, Korean Academy of Science and Technology
    • Assistant Professor, University of Notre Dame
    • Researcher, UC Berkeley
    • Ph.D., Yale Univ.
    • B.S. Mathematics, Seoul National Univ.
  • Byung-Do Lee, CTO
    CTOByung-Do Lee
    • Professor, Digital Security, Cheongju Univ.
    • Professor, Multimedia, Chungbuk Provincial Univ. of Science & Technology
    • Technical Director, Cyber Research
    • Center Director, Cyber Operations Command
  • Jun-Hwan Kim, Auditor
    AuditorJun-Hwan Kim
    • Visiting Professor, Sejong Univ. Graduate School of Business
    • Assistant Governor, Financial Supervisory Service
    • Director General, Bank Supervision, Financial Supervisory Service
    • MBA, New York Univ.
    • B.A. Business, Seoul National Univ.
  • Red team (names withheld)
    Attack verificationRed team
    • Former operations-team-lead-level staff, Cyber Operations Command
Sources · notes

Note Titles and careers as confirmed by the CEO (2026-10-11), most recent first

Sources Company and technology overview (2026-10); IR materials

Chapter 7 · Sources

Sources

Sources from each chapter, grouped by area

7.1 · Sources by area

AreaMaterial
Incidents · threatsFinancial News 2026-10-04·10-07 · Herald Economy 10-03 · Money Today 10-02 · New Daily 10-08 · ZDNet Korea 10-06 · CrowdStrike 2026 GTR · Anthropic 2025-11-13
Global · U.S.Zscaler 10-K FY2026 · morphisec.com · NIST SP 800-53r5·800-160 Vol.2·800-172r3 · NSTC 2011
Company materialsCompany and technology overview (2026-10) · Financial-sector active security proposal (2026-10) · Seoul Metropolitan Government active security proposal (2026-09-11) · KOIST certification test internal check report · IR materials
Tests · patentsRed team penetration test 2026.10 · USPTO 2026.9

Contact

Contact

Co-CEOs
Hyokeun Wang, Yuhan Park
Address
1001, 10th floor, Cheonrok Building, 2, Yeouidaebang-ro 61-gil, Yeongdeungpo-gu, Seoul 07319, Korea Google Maps (opens in a new window)Naver Map (opens in a new window)
Subway
Daebang Station exit 7, 150 m to the left

Talk to us

For enquiries about SMTD (StealthCastle), please use the form below. A specialist will get back to you directly.

Details

Items: name, company, e-mail, phone and message · Purpose: to review and reply to your enquiry · Retention: deleted one year after our reply. You may decline; in that case please e-mail [email protected].

* Required

Or e-mail us: [email protected]