韩国iM银行8月遭AI代理驱动Web Shell攻击被及时阻断、无数据泄露，旧案经国会资料披露

AI-Driven 'Web Shell' Attack Targets Korean Bank's Servers - Seoul Economic Daily
Skip to main content
Seoul Economic Daily
Seoul Economic Daily
KST
Seoul Economic Daily
Korea's Leading Business News Since 1960
한국어
Menu
Saved Articles
Newsletters
AI KEY
Settings
|
Summary
|
Save
A
A
A
A recent artificial intelligence-driven hacking attempt against South Korea's financial sector relied on a web shell, an attack tool that has been in use for decades. The intrusion technique itself differed little from past cases, but analysts said the speed and scale of such attacks could grow sharply as AI agents are used to rapidly scan externally exposed assets and identify vulnerable targets.
According to data submitted to Kim Jae-sup, a People Power Party lawmaker on the National Assembly's National Policy Committee, by the Financial Security Institute, the institute detected an AI agent-based hacking attack on iM Bank on Aug. 28. The attacker uploaded a web shell to a server and then attempted to use it as a foothold to expand into internal systems.
A web shell is a malicious script or program installed by exploiting a vulnerability in a web server, allowing an attacker to execute system commands remotely. Once installed, it can be used to extract system information, install additional malware or serve as a passage for probing other internal servers.
The attack sequence identified by the institute closely resembled conventional web server hacking. The attacker first scanned iM Bank's externally exposed servers to identify vulnerable systems. The attacker then exploited a vulnerability in the Oracle WebLogic T3 protocol to upload a web shell, collected server configuration data and attempted to obtain a list of other internal servers accessible from that server.
What set the case apart from earlier hacking was the use of an AI agent in the initial reconnaissance stage. In the past, attackers had to locate externally exposed servers themselves and analyze each one for weaknesses. An AI agent can automate and accelerate the work of sweeping large numbers of assets and singling out those open to attack.
In this case, the attacker instructed a DeepSeek-based AI agent to search for Oracle WebLogic assets within the financial sector. The AI did not carry out the entire hacking process on its own, but the attacker set the objective and used the AI to sharply improve the efficiency of reconnaissance and asset discovery.
The attack did not result in any data breach. The institute detected it and immediately notified iM Bank, which blocked the attacking IP address and deleted the web shell uploaded to the server. The institute reported the matter to the Financial Services Commission the same day and shared details of the attack with financial companies and related agencies including the Korea Internet & Security Agency, the National Police Agency and the National Intelligence Service. An investigation confirmed that no personal or financial information was leaked.
The institute treated the case as an actual attack in which an AI agent was used against South Korea's financial sector, and shared the attack techniques and response measures with financial companies. It said the wider use of AI agents is increasing the need to systematically manage so-called attack surfaces, including servers and application programming interfaces exposed to the internet.
Security industry officials said the case was notable less for introducing a new hacking method than for showing how pairing AI with a classic intrusion technique widens the speed and scope of attacks. Web shells have long been a standard means of intrusion, but with AI able to rapidly handle the initial reconnaissance of finding vulnerable assets, periodic security checks alone may no longer be enough.
That points to the need to pair vulnerability patching and preventive measures with a continuous response system that detects signs of intrusion in real time and quickly blocks lateral movement inside a network, officials said. Because not every attempt can be stopped in advance, how quickly anomalies such as a web shell upload, unusual command execution or probing of internal servers are spotted can determine the scale of damage.
In this case, the institute's detection of the web shell upload and iM Bank's prompt deletion and blocking prevented further intrusion and any data leak. With AI raising the speed of attackers' reconnaissance, financial firms should go beyond periodic vulnerability checks and strengthen systems to continuously track externally exposed assets and detect and block attack indicators in real time, officials said.
Rep. Kim Jae-sup of the People Power Party. Seoul Economic Daily archive
"When AI is finding vulnerable servers and speeding up attacks, financial companies cannot protect the public's financial information if they stop at periodic checks and after-the-fact responses," Kim said. "Financial authorities must review how financial companies manage externally exposed servers and address security vulnerabilities, and thoroughly verify whether the security systems meant to block further intrusion into internal systems are working properly."
#
WebShell
#
AIHacking
#
Cybersecurity
#
iMBank
#
FinancialSecurity
#
OracleWebLogic
Original reporting by
Lee Jin-seok
for Seoul Economic Daily.
AI-translated from Korean. Quotes from foreign sources are based on Korean-language reports and may not reflect exact original wording.
View Korean original
↗
Translation Policy
Watch · Seoul Economic Daily
More →
0:39
Ending Share Buyback: Foreigners selling off Samsung Electronics
0:39
Most Read This Week
1
-
5
‹
›
1
Military Exemption Boasts Spark Push to Overhaul Athlete Rules
2
Eurozone Rules Out Rescue as France Debt Fears Spread
3
Samsung Quarterly Operating Profit Tops 107 Trillion Won, Beating Nvidia
4
AMRO Lifts Korea's 2026 Growth Forecast Again to 3.3%
5
China's TCL Passes Samsung in LCD TVs, Leads by 0.1 Point
← Back to Home
AI KEY
Preview
↗
Korean Corporate Intelligence Hub
KOSPI · KOSDAQ · 12 sectors
A live, cap-weighted view of every KOSPI and KOSDAQ sector, with same-day Korean reporting distilled by company — built for foreign investors, correspondents and analysts who need to scan Korea before the next session.
Click to explore AI KEY
→
Open AI KEY in full screen
↗
Korea Company Atlas
Preview
↗
Market Ontology · The Feedback Loop
KFTC 2025 · 92 groups · 121,954 articles
An English ontology of the Korean market — how companies, the media, the government and the National Assembly move each other in a loop. Korea's named controlling persons and designated business groups are a mechanism, not a risk to be priced blind.
Click to explore the atlas
→
Open Atlas in full screen
↗
SIGNAL
Now live
↗
English Edition · Capital Markets
M&A · IPO · PE · Fund Flows
SIGNAL English Edition is live — Korea's deal desk reporting in English. M&A, IPOs, private equity and fund flows, covered daily for global institutional investors. Browse free; subscriber-only scoops at the 50% intro rate.
Click to explore SIGNAL
→
Open SIGNAL in full screen
↗