Science & Tech · Cybersecurity · 7 hrs ago
Financial firms were warned of AI cyberattack before data leaks
South Korea’s financial security agency detected an AI-assisted attack on a financial company last month.
The attacker used an AI agent based on DeepSeek to scan for Oracle WebLogic servers, then exploited a software weakness to install malicious code.
The attacker used the compromised server to look for other connected servers, but the company blocked the activity before more malware was downloaded.
The agency shared details at a security seminar on September 17, attended by more than 160 people, including staff from several firms that later had data leaks.
It urged financial firms to keep checking their internet-facing systems because occasional security reviews may miss attacks.
The incident raised concerns that firms had not done enough to prepare, although the account does not say the AI attack caused the later data leaks.
Separately, hacking attempts against four South Korean banks, including the central bank, reached more than 1 million in the first nine months of this year.
A financial company in South Korea detected and blocked an AI-agent cyberattack last month, about two weeks before recent personal-data leaks in the sector.
The Financial Security Institute shared details of the attack with financial firms at a seminar on September 17.
Representatives from more than 160 people attended, including staff from several firms that later had information leaks.
The institute urged firms to continuously check and verify their internet-facing systems rather than rely on one or two security assessments a year.
- Who
- An attacker using an AI agent targeted a financial company. The Financial Security Institute shared details with financial firms.
- What
- The attacker scanned for Oracle WebLogic assets, exploited a remote command execution vulnerability and installed a web shell. The company detected and blocked the attempt before further malware was downloaded.
- When
- The attack occurred last month, about two weeks before recent data leaks. Details were shared at a seminar on September 17.
- Where
- A financial company in South Korea; the article does not identify it.
- Why
- The attacker sought to scan financial-sector Oracle WebLogic assets and explore servers connected to the compromised server.
This story does not have two clearly opposing sides.
One or two assessments a year will not catch attack attempts, so continuous measurement and verification are needed.
The Financial Security Institute identified an AI-agent attack on a South Korean financial company.
The attacker exploited a remote command execution vulnerability and installed a web shell.
The institute shared details of the attack at a seminar for financial-company security staff.
- Attack targets
- Oracle WebLogic assets in the financial sector
- Malicious software
- A web shell
- Seminar date
- September 17
- Seminar attendance
- More than 160 people
- Attack detection
- The company blocked the attempt before further malware was downloaded
Sources
Related news
New characters let lookalike domains bypass some browser checks
Hackers use Bing redirects in Google ads to promote fake Claude installers
Amazon Bedrock flaw exposed AI agent credentials and source code
AhnLab to Enable AI and Internet Access on Research Foundation Work Network
AI system finds 17 security flaws in tests of 50 mobile apps
US seizes two China-linked hacking tools used against critical infrastructure
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
119 databases from Russian companies published online in first nine months of 2026
Study finds car apps share drivers’ data with advertising and analytics firms
