Financial Sector Failed to Act Despite Advance Warning of AI Hacking Threat

It was confirmed on the 11th that the Financial Security Institute (FSI) had already issued a warning two weeks before the hacking incident occurred. About two weeks before the large-scale hacking incident hit the domestic financial sector, on the 17th of last month, the FSI shared examples of hacking attacks using artificial intelligence (AI) and urged firms to prepare in advance. The details were based on materials submitted by the FSI to Rep. Han Chang-min of the Social Democratic Party, a member of the National Assembly's National Policy Committee.

The warning came at a 'Financial AI Security Threat Response Seminar' hosted by the FSI. Some 160 people, including security officers from financial firms, attended the seminar. Among the seven financial firms recently hit by the breach, officials from KB Kookmin Bank, Hana Bank, Hyundai Capital, and Welcome Savings Bank were present in person, and a representative from Shinhan Financial Group also attended.

According to the presentation materials, the attacker instructed a DeepSeek-based AI agent to scan for 'Oracle WebLogic,' a program used by financial firms. WebLogic is a server program that runs websites and apps. The attacker exploited a remote code execution vulnerability in this server software to implant 'web shells,' malicious programs. They then used the compromised server as a foothold to probe other servers connected to the internal network.

At the seminar, the FSI stressed that vulnerabilities in externally exposed systems must be continuously measured and verified, and that such attacks are difficult to detect through routine assessments conducted only once or twice a year.

Rep. Han Chang-min said, "At the National Assembly audit, I will examine whether the financial firms' responses before and after this incident were appropriate and hold them accountable."