AI-driven hacks test Korea's banks as old defenses hit limits

As questions are raised that artificial intelligence (AI) tools may have been used in recent hacking attacks targeting Korea's financial sector, an analysis said it is difficult to respond to AI-based attacks with existing security methods that only block specific strings or attack patterns. Because AI can change its attack method based on a server's response and combine existing web vulnerability attack techniques, the approach of finding and blocking traces of attack tools has limits.

On the 8th, MONITORAPP's threat intelligence unit AI Labs released this analysis in a report titled "Cyberattacks on the financial sector and the AI autonomous penetration testing tool ARTEX."

Earlier, a Chinese administrator string reading "ARTEX-AI autonomous penetration testing console" was found on an attacker infrastructure server suspected of being used in the financial sector breach. In response, the security field took steps to block the string, specific user-agent information, and ARTEX-specific attack patterns at firewalls.

However, AI Labs noted that such measures alone have limits in stopping the attacks. That is because attackers can easily change user-agent information, and the attack payloads (data or code used in attacks) generated by ARTEX are not new techniques but combinations of existing web vulnerability attacks.

According to the report, ARTEX is an open-source, multi-agent framework that connects to existing commercial LLMs, such as Claude and ChatGPT, on the backend. It is designed to have AI agents autonomously perform tasks that hackers previously carried out directly, including preliminary reconnaissance and vulnerability discovery, vulnerability exploitation, and evasion attempts if an attack fails.

AI Labs said that the individual web requests (HTTP) generated in this process resemble existing web vulnerability attacks, making identification and blocking difficult based on a specific tool's attack patterns alone. It added that while traces of ARTEX execution were indeed found on attack infrastructure, official confirmation is needed on whether it was directly executed and used in the actual financial sector attacks.

Meanwhile, AI Labs said that using its own threat intelligence, it secured 50 attacker IP addresses and command-and-control (C2) server domains related to the financial sector attack incident and, after a full inspection of security appliances, additionally detected actual attack signs on some devices, including past intrusion history and preliminary reconnaissance. AI Labs said it urgently reflected the roughly 50 identified attacker IPs and C2 domains in detection patterns and distributed them.