A recent artificial intelligence-driven hacking attempt against South Korea's financial sector relied on a web shell, an attack tool that has been in use for decades. The intrusion technique itself differed little from past cases, but analysts said the speed and scale of such attacks could grow sharply as AI agents are used to rapidly scan externally exposed assets and identify vulnerable targets.
According to data submitted to Kim Jae-sup, a People Power Party lawmaker on the National Assembly's National Policy Committee, by the Financial Security Institute, the institute detected an AI agent-based hacking attack on iM Bank on Aug. 28. The attacker uploaded a web shell to a server and then attempted to use it as a foothold to expand into internal systems.
A web shell is a malicious script or program installed by exploiting a vulnerability in a web server, allowing an attacker to execute system commands remotely. Once installed, it can be used to extract system information, install additional malware or serve as a passage for probing other internal servers.
The attack sequence identified by the institute closely resembled conventional web server hacking. The attacker first scanned iM Bank's externally exposed servers to identify vulnerable systems. The attacker then exploited a vulnerability in the Oracle WebLogic T3 protocol to upload a web shell, collected server configuration data and attempted to obtain a list of other internal servers accessible from that server.
What set the case apart from earlier hacking was the use of an AI agent in the initial reconnaissance stage. In the past, attackers had to locate externally exposed servers themselves and analyze each one for weaknesses. An AI agent can automate and accelerate the work of sweeping large numbers of assets and singling out those open to attack.
In this case, the attacker instructed a DeepSeek-based AI agent to search for Oracle WebLogic assets within the financial sector. The AI did not carry out the entire hacking process on its own, but the attacker set the objective and used the AI to sharply improve the efficiency of reconnaissance and asset discovery.
The attack did not result in any data breach. The institute detected it and immediately notified iM Bank, which blocked the attacking IP address and deleted the web shell uploaded to the server. The institute reported the matter to the Financial Services Commission the same day and shared details of the attack with financial companies and related agencies including the Korea Internet & Security Agency, the National Police Agency and the National Intelligence Service. An investigation confirmed that no personal or financial information was leaked.
The institute treated the case as an actual attack in which an AI agent was used against South Korea's financial sector, and shared the attack techniques and response measures with financial companies. It said the wider use of AI agents is increasing the need to systematically manage so-called attack surfaces, including servers and application programming interfaces exposed to the internet.
Security industry officials said the case was notable less for introducing a new hacking method than for showing how pairing AI with a classic intrusion technique widens the speed and scope of attacks. Web shells have long been a standard means of intrusion, but with AI able to rapidly handle the initial reconnaissance of finding vulnerable assets, periodic security checks alone may no longer be enough.
That points to the need to pair vulnerability patching and preventive measures with a continuous response system that detects signs of intrusion in real time and quickly blocks lateral movement inside a network, officials said. Because not every attempt can be stopped in advance, how quickly anomalies such as a web shell upload, unusual command execution or probing of internal servers are spotted can determine the scale of damage.
In this case, the institute's detection of the web shell upload and iM Bank's prompt deletion and blocking prevented further intrusion and any data leak. With AI raising the speed of attackers' reconnaissance, financial firms should go beyond periodic vulnerability checks and strengthen systems to continuously track externally exposed assets and detect and block attack indicators in real time, officials said.
"When AI is finding vulnerable servers and speeding up attacks, financial companies cannot protect the public's financial information if they stop at periodic checks and after-the-fact responses," Kim said. "Financial authorities must review how financial companies manage externally exposed servers and address security vulnerabilities, and thoroughly verify whether the security systems meant to block further intrusion into internal systems are working properly."