[AI Spotlight] Both Korea and Japan Breached... The 'Small Door' Where Customer Information Leaked

Recently, both Korea and Japan have been suffering from large-scale personal information leaks caused by consecutive hacking incidents.
In Korea, a dedicated inquiry service for commercial bank loan solicitors became a leak path, while in Japan, a department store group's reservation site served as the entry point. Hackers stole customer information by infiltrating through exposed inquiry and reservation services rather than core computing systems.
A domestic security firm that analyzed the successive information leak incidents in both Korea and Japan identified servers connected to publicly exposed business webpages and apps, as well as outsourced services managed by third parties, as common vulnerabilities in its report.
Investigations by Japan's incident response agency revealed that hackers used Artificial Intelligence (AI) to find vulnerabilities and launch attacks. Circumstances also suggest that the same AI penetration tool was used in attacks targeting both Korea and Japan, putting both nations on high hacking alert.
A recent analysis released by Japan's National Institute of Information and Communications Technology (NICT) demonstrates the process by which apps become clues for attacks.
Hackers obtain and analyze publicly available Android apps to determine which servers they connect to and how they exchange information, then attack those specific servers. NICT has named this an 'A2B' (App-to-Backend) attack.
A backend server is a system that handles login authentication and user information management behind the app screen, and the channel through which the app and server exchange information is called an Application Programming Interface (API).
NICT pointed out that even if the app itself has no vulnerabilities, personal information leaks can occur if the server fails to properly verify the user's identity or information access permissions. Furthermore, they warned that the use of AI accelerates app analysis and vulnerability searching, which could cause such attacks to spread to more systems.
The fact that AI was mobilized in actual attacks was confirmed by JPCERT/CC, Japan's incident response agency.
In a recently released investigation, JPCERT/CC stated that they confirmed hackers used AI to search for existing vulnerabilities and attacked through APIs.
In the investigated servers, Android app distribution files and files related to app analysis tools were discovered, along with traces of investigations into whether the APIs found through app analysis had vulnerabilities. These attack servers were also attacking web services outside of Japan.
There is also a name that appeared commonly in the attacks on both Korea and Japan: 'ARTEX', an AI-based automated penetration testing tool.
According to an AhnLab report, the domestic security industry first discovered ARTEX-related strings on web servers used in attacks against the financial sector.
In Japan, local security firm GMO Cybersecurity by Era announced last month that they found ARTEX in the infrastructure used to attack Japanese companies.
When researchers gave only short instructions to penetrate the target at a level that even someone without security knowledge could input, ARTEX identified the file upload function of the web server. It then proceeded to execute programs using a web shell (a malicious script that executes commands on a server) without human intervention.
[AI Spotlight] Both Korea and Japan Breached... The 'Small Door' Where Customer Information Leaked Naver News From bank loan inquiries to department store reservations... Exposed external services serve as attack paths. Traces of the AI tool ARTEX found in attacks on both Korea and Japan... No conclusive evidence of the same attacker yet. Recently, both Korea and Japan have been suffering from large-scale personal information leaks caused by consecutive hacking incidents.