Traces of ‘AI autonomous penetration testing console’ discovered on server related to Shinhan Bank customer information leakage incident

Unconfirmed whether the attack is actually used... Expert "suspects automation of AI-based attacks

(Seoul = Yonhap News) Reporter Kwon Ha-young = Traces of a Chinese-based open source artificial intelligence (AI) penetration testing tool were found on a server believed to have been used in a cyber attack in connection with the Shinhan Bank customer information leak incident.

According to the security industry on the 2nd, the string 'ARTEX-self-administered search engine' was confirmed in the HTML title of the web server used in the credential stuffing (random information substitution technique) attack believed to be targeting Shinhan Bank.

This is an expression meaning ‘AI autonomous penetration testing console,’ and can be interpreted as evidence showing the possibility that ‘ARTEX AI’ was operated in the relevant infrastructure or that a related environment was utilized.

Moon Jong-hyun, head of the Genius [263860] security center, made this diagnosis through his LinkedIn that day.

ARTEX AI is a large-scale language model (LLM)-based autonomous penetration testing system released as open source on GitHub, focusing on Chinese.

It is designed to use LLM and a multi-agent structure to automate the process from information collection to vulnerability exploration, attack route planning, security tool execution, and vulnerability verification.

Center Director Jonghyun Moon said, “Several threat analysts reasonably suspect that AI-based attack automation tools were used during this financial company attack.”

He pointed out, "On the surface, it is a tool developed to support security checks and penetration testing, but while it can be used as an efficient penetration testing tool in a permitted security verification environment, if abused by an attacker, it has the potential to be used as a means of increasing the automation and efficiency of actual cyber attacks."

ARTEX AI was introduced as the winning project in the 'Agent+' defense ability challenge led by China's Baidu BSRC this year.

However, it has not been confirmed through official agencies such as financial authorities or Shinhan Bank whether ARTEX AI was actually used in the attack during the Shinhan Bank hacking process.

Previously, Shinhan Bank announced on the 30th of last month that it had confirmed that the personal information of about 25,000 customers had been leaked by an external unauthorized person who bypassed the identity verification process of the loan originator service.