The wave of data breaches that hit South Korea and Japan this autumn did not start where defenders spend most of their money. According to a new analysis from AhnLab's ASEC team, the intruders came in through side doors: a loan-broker lookup page, an employee sales tool, a reservation site, an outsourced email service, and data files nobody remembered to delete.
That matters because AI attack agents now scan for exactly those side doors, and AhnLab says its own lab test showed one breaking in with almost no human help.
Sixteen banks, one weak periphery
The Korean financial sector breaches began at commercial banks in late September. By October 14, regulators had counted 16 affected financial institutions, with roughly 100,000 personal records confirmed leaked.
None of the disclosed entry points were core banking systems. At one bank, attackers bypassed authentication on an inquiry service used only by loan brokers and fed it repeated queries, pulling loan data on about 25,000 people. When regulators inspected 555 financial institutions in early October, 130 reported deficiencies, mostly missing patches, unsupported systems and no round-the-clock monitoring.
Outside finance the pattern repeated, from a coffee chain that leaked about 2.76 million records from temporary cloud files left over from an old service overhaul, to an accounting software maker serving more than 110,000 businesses, breached via employee VPN accounts and a backup product (its scope is still under investigation).
Japan's leaks came through its apps
Japan's numbers are sharper. Citing Japanese firm Marknica, ASEC reports 119 announced web-system data leaks as of October 6, already above 2025's full-year 84, with 81 of them since July. Japanese authorities blame one technique in particular, which NICT named "App-to-Backend" (A2B) attacks: pull apart a public Android app, map the server APIs it talks to, then exploit flaws on the server side. We covered that finding when NICT published it.
Disclosed cases include a member lookup API abused for four days, exposing up to about 22.52 million records, and a department store reservation site that opened a group-wide customer database of about 1.26 million records.
An AI agent that needs one sentence
The common thread on the attack side is ARTEX, an AI-powered automated penetration testing tool first tied to the Korean bank intrusions. ASEC has tracked exposed ARTEX operator systems growing from about 600 IP addresses to more than 900 by October 14.
The firm then ran ARTEX in its own test environment. Given only a short instruction to penetrate the target, the agent found a file upload function on a web server and planted a web shell without human intervention. Against an exposed Apache ActiveMQ instance it used the known flaw CVE-2023-46604 to get in and then ran commands on four internal hosts. Neither test needed a new technique.
The original ARTEX repository is gone, but ASEC found renamed forks still circulating, configured for several large language models including DeepSeek, GLM, Kimi and Claude, some bundling a public exploit and IRC-based remote control code. In late October Korean police arrested the first suspect accused of hacking with generative AI; police say the group combined ARTEX with an AI coding agent to steal about 8.2 million records from about 90 Korean companies, but found no confirmed link to the financial sector breaches. In Microsoft's account of Storm-0940's ARTEX-assisted campaign, brute-force login attempts of up to 2,900 a minute all failed, and the real break-in came through a trusted third-party app's credentials.
Inventory the side doors before an agent does
ASEC's advice starts with an inventory: list every internet-facing service, API, management page and remote access point, give each an owner, and shut off unused and test servers. Assume any mobile app will be reverse engineered, so enforce authentication and object-level authorization on the server for every API call, keep keys out of the app, and cap and alert on repetitive per-user queries. Keep BI tools and admin pages off the open internet, or behind IP restrictions and multi-factor authentication, and delete data past its retention period.
The uncomfortable conclusion is economic. An agent that works around the clock at almost no cost will try every forgotten subdomain a human attacker would have skipped, so the smallest system on the perimeter now deserves the same patching discipline as the biggest.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.