A group that used generative artificial intelligence (AI) to hack approximately 90 domestic companies, hospitals, and academies, stealing over 8.2 million personal data records, was apprehended by police. This is the first case in Korea of arresting suspects involved in large-scale hacking crimes that abused generative AI. Concerns have grown that anyone can easily commit large-scale hacking crimes using AI, as it was revealed that the mastermind caught is a non-specialist in information technology (IT).
The Cyber Investigation Division of the Seoul Metropolitan Police Agency said Monday that it has remanded to custody Mr. A (32), the mastermind, on charges of violating the Information and Communications Network Act and extortion, among others, and is investigating six accomplices without detention.
According to police, Mr. A's group is suspected of infiltrating the computer systems of approximately 90 domestic companies from September last year until this month using generative AI and other tools, leaking a total of over 8.2 million personal data records and internal materials.
The victim companies included academies, hospitals, golf courses, subsidiaries of large conglomerates, and second-tier financial institutions. Specifically, personal data was leaked from △ three insurance sales companies (3.22 million records) △ three funeral service companies (1.43 million records) △ 21 golf courses (1.2 million records) △ 12 academies (990,000 records), among others.
It was determined that they threatened 38 companies via email and have demanded a total of 360 million won in money so far. Investigations revealed that the victims were pressured with claims that if the personal data leak became public, it would damage corporate image and lead to the imposition of fines and customer lawsuits for damages.
Police believe there may be additional victim companies that did not report the incident due to fear of retaliation, and are conducting investigations into additional companies and demanded amounts.
This investigation began in June last year with a complaint from one victim company. Subsequently, as reports of damage using the same method followed across the country, the Seoul Metropolitan Police Agency Cyber Investigation Team was designated as the responsible investigative agency in August last year to conduct a consolidated investigation.
Police sequentially apprehended five accomplices who threatened employees of victim companies via phone and text messages between July and September last year. Following this, they identified the identity of accomplice Mr. B (24), who instigated them through Telegram, and arrested him in early this month.
Police established an "Internal Network Generative AI Analysis System" and developed three AI analysis tools, which were utilized in this arrest. These tools correspond to △ an integrated investigation data analysis tool △ an investigation data wiki tool △ and an information and communications network intrusion log analysis tool.
Based on these, the investigation team analyzed evidence and apprehended all suspects within four months of initiating the investigation. It was determined that they identified masterminds Mr. A and Mr. B using the integrated investigation data analysis tool.
Mastermind Mr. A was revealed to be a non-specialist in IT. Investigations showed he self-taught hacking techniques through blogs, etc., and utilized them for the crime. He also has experience performing penetration testing work at a security company for three years from 2019 to 2022.
In the early stages of the crime, Mr. A directly operated reconnaissance tools to find security vulnerabilities in websites and automation tools to divert personal information. However, starting last August, he began actively utilizing generative AI, rapidly expanding the scale of the crime. According to police investigations, out of the approximately 90 domestic companies hacked by Mr. A, 60 were breached using generative AI. The period it took Mr. A to hack these companies using AI was just over 40 days.
Traditional hacking methods required identifying vulnerabilities in the target and then directly finding and applying appropriate tools for the situation. In contrast, generative AI can find necessary tools and present problem-solving processes when a goal is input. This means that as the time and technical burden required for hacking decrease, the targets and scope of attacks may also expand.
Particularly, concerns are heightened by the fact that Mr. A combined and utilized the AI autonomous penetration testing system "ARTEX" and coding agent tools in this crime. This is because cases of hacking abusing ARTEX have continued recently both domestically and internationally.
Notably, it is known that ARTEX was used in a large-scale personal data leak incident targeting the domestic financial sector last September. The U.S.-based Microsoft announced on the 21st last month that a hacking organization linked to China used ARTEX to attack hundreds of institutional investors worldwide.
A police official stated, "This case is an example showing that AI is lowering the barriers to entry for cyberterrorism crimes, in that even individuals, not professional hacker organizations, can conduct large-scale hacking against multiple companies with the help of AI."
in TECH
