“Has an AI Automation Attack Begun?” Industry Warns After String of Financial Security Incidents
TECHWORLD ·
✦ AI Summary
Seven major domestic financial companies suffered a series of security incidents, with the leak volume estimated at personal information on about 66,000 people and about 2,200 corporate records.
Data leaks continued at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Hyundai Capital, and Welcome Savings Bank.
CrowdStrike Intelligence said it found ARTEX configuration files and Claude Code session logs, and that attacks on domestic financial institutions using ARTEX and LLMs were identified from late last month to early this month.
Recently, a series of security incidents at domestic financial companies has heightened tension across the industry. As of industry tallies on the 8th, seven major domestic financial firms had suffered a chain of security breaches, and the scale of the leaks was estimated at personal information on about 66,000 people and about 2,200 corporate records.
The first party to disclose an incident was Shinhan Bank. On September 29, a hacking incident occurred on 'M Shinhan,' the mobile website for loan brokers, and personal information on about 25,000 people was leaked. After that, additional personal data leaks were reported at KB Kookmin Bank, Hana Bank, and BNK Busan Bank. At KB Kookmin Bank, the employee-only mobile work support system was hacked, putting 119 people, including employees and customers, on the leak list. At Hana Bank, information on 89 customers was leaked through a hacking of its sales support system. At BNK Busan Bank, the personal information of 11 outsourced developers was leaked.
Regarding this attack, the possibility of an automated attack using AI has been raised. Accordingly, voices inside and outside the industry are warning that stronger security measures capable of countering AI attacks are needed.
Hacking incidents are also continuing in the secondary financial sector. On October 2, information on about 40,000 people was leaked at Yegaram Savings Bank. On October 3, personal information on 146 housing-loan brokers at Hyundai Capital was leaked, and on the same day, Welcome Savings Bank saw the leak of information on about 2,200 corporate customers.
In the meantime, one issue in the latest incident has been the possible use of AI automation attack tools. The industry claimed it had detected signs related to ARTEX AI, a Chinese-language open-source AI penetration testing tool, in the attack infrastructure targeting the financial sector. It also raised the possibility of automated attacks using AI agents.
CrowdStrike Intelligence found an ARTEX configuration file on the attacker's managed server and also discovered Claude Code session logs. Based on that analysis, it identified attacks on domestic financial institutions using ARTEX and a large language model (LLM) from late last month to early this month.
CrowdStrike Intelligence judged that, in this activity, the attacker used AI tools to make repeated intrusions in a short period of time. It also said it expects attackers to continue experimenting with introducing AI tools into offensive operations in the future to improve operational speed and capabilities.
This assessment aligns with what the security industry has been repeatedly warning about regarding the attack automation trend driven by advances in AI technology. Industry players have pointed out that existing security alone has limits in response, and that AI can drastically reduce the time and cost required for attacks. They also noted that poorly managed systems are more likely to become targets. In fact, the targets in this latest financial-sector incident were not core banking systems but peripheral systems with relatively weak security management, and Enkiwhitehat explained that the financial systems targeted in this attack were external-facing systems that had not been sufficiently verified.
Enkiwhitehat said the financial sector holds highly valuable information and has similar system configurations, making it easy to repeatedly apply a method secured once to multiple institutions. It also urged consideration that if the latest attack was carried out with automation tools, non-financial companies exposed to the same method may already be under reconnaissance. It said security checks on non-financial companies are needed.
After the incidents in the financial sector, several domestic security companies are arguing for the need to introduce AI defense systems. The security industry sees the scope of the latest incidents as not limited to the financial sector and is calling for a shift in response, given the possibility that the threat pattern could spread beyond finance. Pointing to the limitations of existing defense methods, it is also raising the need for the rapid establishment of AI-based security systems.
The industry says hackers are using AI agents to attack vulnerabilities, while new attack techniques continue to emerge. Industry officials also cited cases in the field where basic security measures were not implemented, stressing that the introduction of AI-based security systems and the continuous inspection and remediation of existing vulnerabilities must proceed in parallel.
Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=407966
References
This article was produced with the help of an automated content generation algorithm.
Source: TECHWORLD
View originalThis article was summarized and organized by BizCrush based on the original article from TECHWORLD. For exact quotations and full details, please refer to the original article.