South Korean banks are increasing their investment in AI-powered cybersecurity following a series of breaches. However, CrowdStrike warns that they must also address basic security gaps that allowed an inexperienced hacker to compromise financial institutions. CrowdStrike’s investigation, detailed in its Oct. 7 report, traced the attacker’s servers and recovered AI session records, revealing how the intrusions were carried out. These findings were presented to Korean reporters the following day.
The attacker utilized ARTEX, a Chinese-developed AI penetration-testing tool, alongside large language models to target Korean financial institutions. Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, explained that these tools handled tasks previously requiring specialist knowledge, such as finding website vulnerabilities and carrying out SQL injection attacks. Meyers emphasized that the AI essentially replaced the need for human expertise, enabling the attacker to carry out the entire operation. “All of it,” he said when asked what the AI had accomplished for the attacker.
AI supplied the skills, security gaps provided the opening
Meyers noted that the attacker focused on supporting systems used by employees or loan brokers, rather than the banks’ core platforms. He stressed the importance of thorough security testing across all assets, not just central systems. The oversight in testing peripheral systems left them exposed, highlighting a critical gap in security hygiene. Meyers pointed out that while AI tools provided the attacker with advanced capabilities, the lack of basic security measures on these systems was the primary enabler of the breaches.
South Korea’s financial regulators have confirmed hacking incidents at 16 financial companies, compromising the personal information of approximately 100,000 people. Not all incidents are linked to the same AI-assisted campaign, but the breaches emphasize the need to address both AI-driven threats and foundational security weaknesses.
Read Also: Kenya’s fuel levy debt plan delays road fixes
AI defenses must go hand in hand with basic security
At Monday’s parliamentary hearing, bank executives pledged stronger cybersecurity measures, including expanded use of AI. Meyers urged banks to focus on both AI-powered defenses and improvements to existing security controls. He emphasized the necessity for rapid vulnerability detection, robust processes, and proper personnel training. “They need to do both,” he said when asked about prioritizing AI defenses or existing security improvements.
“The primary requirement is identifying vulnerabilities rapidly,” Meyers added. “Whether an organization accomplishes that through human teams or through AI matters less than maturing their processes, leveraging technology to locate and patch weaknesses, and training their personnel properly.”
Recent parliamentary findings have drawn attention to these fundamentals. Yegaram Savings Bank, which suffered a breach affecting more than 42,000 customers, was found to be running a decade-old version of database software with an unresolved vulnerability. It remains unclear whether that weakness was exploited in the attack. In contrast, Woori Bank, which reported no data leak despite being targeted, cited additional employee authentication measures as a possible reason it avoided damage.
Meyers advocated for the use of AI-powered security testing tools to identify weaknesses before attackers exploit them, while maintaining monitoring systems capable of detecting suspicious activity across networks. He noted that the growing availability of such tools means companies can no longer rely solely on periodic security checks. “Really, it becomes a matter of you needing to test before the bad guys test,” he said.
Leave a Reply