Financial Services Commission Chairman Lee Eog-weon answers lawmakers during a National Assembly audit in Yeongdeungpo District, western Seoul, on Oct. 8.NEWS1
The financial watchdog has warned financial firms that blocking suspicious IP addresses alone will not be enough to stop a wave of suspected AI-powered cyberattacks.
The Financial Supervisory Service (FSS) identified two suspicious IP addresses in a document sent to firms on Sept. 30 and explicitly noted the “suspected use of AI agents,” data submitted to Rep. Park Sung-hoon of the main opposition People Power Party showed on Thursday.
The initial guidance instructed financial firms to check whether their systems had communicated with the addresses and block further connections.
The concern follows a recent string of AI-based cyberattacks that have leaked personal information in institutions such as major commercial banks and even churches.
More suspicious IP addresses have since been added, and the number of addresses financial firms must check and block has continued to grow.
Six notices sent to financial firms through Tuesday listed 35 suspicious IP addresses, or 30 unique addresses after duplicates were removed. That was up from 33 addresses, or 28 unique addresses, reported by the FSS through Monday.
The FSS spelled out the limits of IP blocking in separate guidance sent on Tuesday.
ATMs operated by several banks stand in Seoul on Oct. 4. Financial institutions are on heightened alert after AI-powered cyberattacks targeted several major commercial banks and leaked customer information.YONHAP
“IP blocking alone has limitations because attackers can change their source IP addresses through proxies and other means,” the FSS said. “Detection and response should instead be strengthened by focusing on patterns in requests and responses.”
A proxy is a server that relays internet traffic. Attackers can use proxies to change their IP addresses and reconnect through different addresses even after earlier ones have been blocked.
The FSS also urged financial firms to consider limits on the number of requests made through individual accounts, sessions and application programming interfaces, as well as measures to block abnormal input.
The key, the watchdog said, is to focus less on who is connecting and more on how the connection is being made.
Suspicious behavior could include repeated requests for the same function within a short period or a new request that immediately reflects information contained in an error message. The FSS also told firms to analyze requests together when attackers spread them out over time while rotating through different IP addresses.
Financial Supervisory Service building in Yeongdeungpo District, western SeoulYONHAP
“AI hacking threats are increasing, but our response remains inadequate even in some basic areas,” Financial Services Commission Chairman Lee Eog-weon said during a National Assembly audit on Thursday. “We will conduct a thorough review and make the necessary changes.”
The government is also seeking to ease network separation rules while maintaining security safeguards.
“Ultimately, we have no choice but to use AI to defend against AI,” Lee added.
U.S. cybersecurity company CrowdStrike raised the possibility that the person behind the recent attacks on Korea’s financial sector is a 26-year-old living in Guangdong Province, China, in an analysis released on Wednesday.
The company said it found clues in chat records from Claude Code, an AI coding tool, that remained on a server linked to the attacks. The user had entered details such as their age and place of residence while asking the tool to prepare a job resume.
CrowdStrike, however, acknowledged thatthe information was not enough to conclusively identify the attacker.
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
