SK Shielders diagnosed that, based on its recent analysis of breach incidents in the financial sector, the core risk of AI-based attacks lies not in new hacking techniques but in automating and enhancing existing attacks.
On the 8th, SK Shielders released a guide titled "In the Era of AI-Automated Attacks: Analysis and Response Guide for Breach Incidents Targeting Shadow IT," urging companies to strengthen management of externally exposed assets and APIs.
SK Shielders analyzed that, based on a synthesis of currently disclosed incident circumstances, recent financial sector breach incidents are closer to cases where AI enabled existing attack processes to be carried out rapidly and at scale, rather than cases where AI generated new attack techniques.
Attackers first targeted relatively vulnerable externally exposed assets with weaker management, such as loan solicitor systems, employee support services, and sales support platforms, over core financial transaction systems. It was assessed that AI played a role in simultaneously scanning systems and APIs exposed on the internet and rapidly expanding the scope of attack targets.
SK Shielders' white hacker organization EQST also analyzed 'ARTEX,' an AI-based penetration testing tool suspected to have been used in the attacks. ARTEX is an open-source platform that automates the simulated hacking procedures previously performed by humans, allowing it to select the next scanning target based on previous results and expand attack paths.
SK Shielders explained that this structure can significantly increase the speed and scope of attacks by automating reconnaissance, vulnerability scanning, and verification processes. The actual attacks were also carried out based on existing attack stages such as scanning externally exposed assets, verifying authentication and authorization vulnerabilities, bulk queries, and bypassing blocks, with AI amplifying these processes.
In particular, 'Shadow IT' was identified as a key risk factor. Shadow IT refers to systems, services, and APIs operated outside the management lists or control scope of security organizations. It includes not only assets whose existence is unknown but also assets that are known yet deprioritized in management and thus not properly inspected.
Neglected test servers, legacy web applications, outsourced operation systems, and integrated SaaS are representative examples. SK Shielders explained that the essence of AI attacks lies not in creating new vulnerabilities but in finding and exploiting these blind spots in management more quickly.
API security was also cited as a major task. This is because in environments where corporate operations are connected through APIs, AI can mimic normal calling patterns to perform large-scale scanning and information collection.
As response measures, SK Shielders proposed a three-stage system: 'Identification' of externally exposed APIs and Shadow IT; 'Monitoring' of authentication/authorization systems and calling behaviors; and 'Detection and Response' linking WAF, EDR, NDR, SIEM, etc.
It emphasized the need to move beyond methods that look only at IP addresses. It explained that AI-automated attacks must be identified through behavior-based analysis of users, sessions, access patterns, etc.
SK Shielders viewed that even as AI attacks spread, the basic principles of security do not change. It stated that a zero-trust system is needed, starting with protecting externally exposed assets and APIs, to control users, devices, networks, applications, data, and overall visibility.
Kim Byung-moo, Senior Vice President and Head of Cyber Business Division at SK Shielders, said, "AI is not a technology that creates new vulnerabilities but a tool that amplifies attacks," adding, "Companies must ensure visibility of their assets and strengthen control over externally exposed areas, including APIs."
in TECH
