‘AI Autonomous Penetration Test Console’ string on the suspected attack server
Circumstances related to open source ARTEX AI… Actual use is unconfirmed
(Seoul = Yonhap News) Reporter Kwon Ha-young = Circumstances showing the possibility that a tool that automatically performs the hacking process was used by an artificial intelligence (AI) agent was captured in an incident in which the personal information of approximately 25,000 Shinhan Bank customers was leaked.
On the server presumed to have been used in the attack, traces of a Chinese-based autonomous infiltration tool that uses AI to find vulnerabilities and plot attack routes on behalf of humans were discovered. It has not yet been confirmed whether this tool was used in the actual attack.
◇ ‘AI autonomous penetration testing console’ on the attack server… ARTEX AI related situation
According to the security industry on the 2nd, the string 'ARTEX-self-administered search engine' was confirmed in the HTML title of the web server used in the credential stuffing (random information substitution technique) attack believed to be targeting Shinhan Bank.
This is an expression meaning ‘AI autonomous penetration testing console,’ and can be interpreted as evidence showing the possibility that ‘ARTEX AI’ was operated in the relevant infrastructure or that a related environment was utilized.
Moon Jong-hyun, head of the Genius [263860] security center, made this diagnosis through his LinkedIn that day.
The HTML title is the page title displayed at the top of the web browser tab or window. Simply put, the phrase 'AI Autonomous Penetration Test Console' in Chinese is exposed as is in the title of the page of the web server used in the attack.
Credential stuffing is a hacking method in which an attacker brute-forces a combination of information, such as IDs and passwords, obtained in advance into multiple systems.
Typically, they illegally trade and collect ID and password data used for specific sites on information black markets such as the dark web, and then target users' practices of using the same ID and password on multiple sites.
In the past, attackers had to repeat these inputs manually, but recently, tools that automate this process with AI are increasingly being used.
ARTEX AI is a large-scale language model (LLM)-based autonomous penetration testing system released as open source on GitHub, focusing on Chinese.
It is designed to use LLM and a multi-agent structure to automate the process from information collection to vulnerability exploration, attack route planning, security tool execution, and vulnerability verification.
However, even technology developed for security checks can turn into a hacking tool if it falls into the hands of an attacker.
◇ Security AI becomes an automated hacking tool... It is unclear whether the attack will actually be used
Center Director Jonghyun Moon said, “Several threat analysts reasonably suspect that AI-based attack automation tools were used during this financial company attack.”
He pointed out, "On the surface, it is a tool developed to support security checks and penetration testing, but while it can be used as an efficient penetration testing tool in a permitted security verification environment, if abused by an attacker, it has the potential to be used as a means of increasing the automation and efficiency of actual cyber attacks."
As ARTEX AI is software (SW) released as open source, one of the concerns is that anyone can download and use it without separate approval.
One security expert mentioned this and said, "Although Chinese strings exist, the attacker's identity cannot be easily guessed as it is open source software that anyone can use. The biggest problem is that automation of attacks using open source software can become increasingly widespread."
ARTEX AI was introduced as the winning project in the 'Agent+' defense ability challenge led by China's Baidu BSRC this year.
However, it has not been confirmed through official agencies such as financial authorities or Shinhan Bank whether ARTEX AI was actually used in the attack during the Shinhan Bank hacking process.
Previously, Shinhan Bank announced on the 30th of last month that it had confirmed that the personal information of about 25,000 customers had been leaked by an external unauthorized person who bypassed the identity verification process of the loan originator service.
