Although AI is being utilized across the entire hacking process, from vulnerability scanning to writing attack code, it has been confirmed that there are no separate government statistics in South Korea to verify how many cyberattacks utilizing AI have occurred. This is because, while aggregating data on intrusion incidents and cybercrimes, whether AI was used is not recorded separately.
According to the AI industry and the government on the 5th, when a report of an intrusion incident is received, the Ministry of Science and ICT investigates the entry path of the malware, the vulnerabilities exploited in the attack, and the penetration route. However, there is no item in the intrusion incident investigation report that records whether AI was used. Because it is not separately verified whether the attacker used generative AI or AI coding tools, statistics are not aggregated.
A Ministry of Science and ICT official stated, "In intrusion incident investigations, we analyze the causes of the incident, such as the entry path of malware and the vulnerabilities exploited in the attack, but it is realistically difficult to verify whether the attacker utilized AI tools."
This is because while the results of the attack, such as access logs, malware, and exploited vulnerabilities, remain on the victim system, there are no traces left of the process by which the attacker used external AI to find vulnerabilities or write attack code. A Ministry of Science and ICT official said, "Utilizing AI can make vulnerability scanning more sophisticated and increase attack speed, for example, completing tasks that previously took 10 minutes in just one minute," but added, "What the investigation institutional investor confirms is the result of the attack and the penetration route, making it difficult to determine what tools were actually used during the attack process."
The police also do not have separate statistics. While the use of generative AI or AI coding tools may be identified during investigations, this is not separately aggregated as 'AI-utilized hacking.'
A National Police Agency official said, "Using generative AI tools is a criminal means," and added, "The police aggregate statistics based on charges such as hacking or fraud." The official continued, "If existing cases are individually reviewed, it is possible to verify whether AI was used, but there are no separate statistics dedicated solely to that purpose."
If records of AI service usage are required, international cooperation with overseas operators is also possible, but this too does not separately aggregate AI-related requests. The National Intelligence Service confirms the misuse of AI by international and state-sponsored hacking organizations. The National Intelligence Service told MoneyToday, "We are responding in a multi-faceted manner to various hacking cases and methods, including cyber threats involving the misuse of AI by international and state-sponsored hacking organizations, in cooperation with overseas intelligence and security institutional investors." However, specific cases and numbers were not disclosed for reasons such as exposing response capabilities.
The security industry already views AI as being widely utilized in vulnerability scanning, writing attack code, and analyzing and modifying malware. An industry official asked rhetorically, "How many hacking attacks these days do not utilize AI at all?"
Experts point out that even if it is difficult to perfectly prove whether AI was used, related information should be accumulated. Lee Seong-yeop, a professor of Technology Management at Korea University, said, "Hacking utilizing AI means that the attacker's capabilities have become that much stronger," and added, "If hackers use AI, we must prepare so that defense can also utilize AI." He continued, "To create systems safe from hacking, it is necessary to analyze the causes and provide appropriate remedies," emphasizing, "It is necessary to distinguish whether AI was used as an auxiliary tool or actually executed the attack, accumulate data accordingly, and develop response measures suited to that."
in TECH
