Cybersecurity authorities and businesses in South Korea and Japan are confronting a growing wave of digital attacks as artificial intelligence makes certain stages of cybercrime faster and easier to automate.
A Reuters report published on October 9 described an increase in attacks affecting organisations in both countries, including financial institutions and major businesses.
The developments have intensified concerns that AI tools could allow less technically experienced attackers to conduct more sophisticated campaigns.
How AI changes the threat landscape
Artificial intelligence can assist with tasks such as analysing publicly available information, drafting convincing messages and automating parts of software development.
These capabilities can also be misused.
Attackers may use AI to produce more personalised phishing messages, translate scams into different languages or automate repetitive stages of reconnaissance.
This does not mean AI can independently carry out every complex cyberattack. Successful intrusions still depend on factors such as vulnerable systems, stolen credentials, poor security practices and the ability to evade defensive controls.
But reducing the time and effort required for certain tasks can increase the number of attempts attackers make.
Attacks across South Korea and Japan
Reuters reported that nine banks and two major churches in South Korea had been targeted, while Japanese organisations including Daiwa Securities, SoftBank and Lawson had reported breaches.
The report also cited an increase in Japanese incidents during September compared with August.
CrowdStrike linked a China-based hacker’s use of AI tools to attacks against South Korean banks, according to the coverage.
These cases illustrate the importance of investigating how attacks were conducted rather than assuming that every incident involving AI was caused by an autonomous system.
Security researchers must distinguish between the use of AI for writing or analysing information and more advanced automation that meaningfully changes an attacker’s capabilities.
Source: Reuters — South Korea and Japan face AI-assisted cyber threats.
Why financial institutions are attractive targets
Banks and financial services companies handle sensitive personal information and high-value transactions. A successful breach can expose customer data, disrupt operations and undermine trust.
Retailers and telecommunications companies also hold valuable information and operate services that customers expect to be available continuously.
Attackers do not always need to break through sophisticated technical defences directly. They may exploit weak passwords, unpatched software, misconfigured systems or employees tricked into revealing credentials.
AI can make some social-engineering attempts more convincing, increasing the importance of identity verification and employee awareness.
What organisations should do now
Businesses should strengthen multi-factor authentication, patch exposed systems promptly and monitor unusual account activity.
Security teams should also test incident-response procedures, maintain reliable backups and restrict the access available to each employee or application.
AI-specific safeguards are increasingly important too. Organisations deploying AI agents should limit permissions, monitor automated actions and prevent systems from accessing sensitive resources unnecessarily.
Security teams can use AI defensively to analyse alerts and investigate suspicious activity, but automated recommendations should be validated before consequential actions are taken.
The next phase of cybersecurity
The growing availability of AI tools creates opportunities for both defenders and attackers.
Organisations that respond effectively will need to combine technical controls, skilled security professionals and clear processes for managing incidents.
The objective is not simply to adopt AI security products. It is to reduce the likelihood that an attack succeeds and limit the damage if one does.
The bottom line: AI is changing the economics of cybercrime, but strong identity controls, timely updates and disciplined security practices remain among the most important defences.
