INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Pyongyang Calls for AI-Based Countermeasures Against Cyber Threats

| 2026-10-08 13:31 MEDIUM MEDIUM AI-ENABLED ATTACK RANSOMWARE & EXTORTION VULNERABILITY DISCLOSURE CYBERATTACK (GENERAL) INDUSTRY & POLICY
JSON
Executive Summary
AI-generated
Pyongyang has called for the use of AI-based countermeasures in response to cyber attacks, citing the need for the CTEM (Cyber Threat Emergency Management) system. The attack is attributed to PyoLink, a representative from DataNet, who introduced an AI-based cybersecurity threat management platform 'Blue Hunter' to address continuous threat exposure management (CTEM) in the financial sector. This incident affects 1 organization: PyoLink and potentially others using their services. The attack works by combining various web attacks, including SQL injection, cross-site scripting (XSS), automated account attacks, credential spoofing, abnormal web and API requests, and attempts to exploit vulnerabilities. As of now, the current status is unclear as no further information on the incident's outcome or impact has been provided in this source.
Technical Mitigations AI-generated
• Blue Hunter AI-based CTEM system to detect and respond to attacks • CVE-2022-22965: Patch the vulnerability in 'WebFront-K' web firewall before it can be exploited by attackers • Pyriank's WebFront-K signature to block ARTEX-related attacks, including SQL injection, cross-site scripting (XSS), and other web attacks
Technical Observables
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Cobalt StrikeCobalt Strike
Target & Sectors
FIVE_EYES FIVE_EYES NORTH_AMERICA NORTH_AMERICA retailretail financefinance manufacturingmanufacturing energyenergy
Incident Timeline
‎September 27, 2026
Threat actors used a combination of the Claude code and Cobalt Strike tools in AI-powered attacks targeting multiple sectors, including Finance, Retail, Energy, and Manufacturing.
industry Finance
General Document Context
industry Retail
General Document Context
industry Energy
General Document Context
industry Manufacturing
General Document Context
‎2026/10/05
A senior military officer expressed concerns after visiting the cyber security booth at the 'AI Festival 26' held at COEX in Gangnam, Seoul.
organisation the '
" A senior officer from the military, who visited the cyber security booth at the 'AI Festival 26' held at COEX in Gangnam, Seoul, yesterday, expressed his concerns, taking a deep breath.
general_metric 26 AI Festival
" A senior officer from the military, who visited the cyber security booth at the 'AI Festival 26' held at COEX in Gangnam, Seoul, yesterday, expressed his concerns, taking a deep breath.
‎2026/10/06
Ransomware programs are now being created faster by AI than by humans, according to Hong Seung-gyun, CEO of cybersecurity firm Everzon.
tactic Ransomware
Today, we spoke with Hong Seung-gyun, CEO of cybersecurity firm Everzon, who stated, "Ransomware programs are now being created faster by AI than by humans."
organisation Korea Southern Power Company
In fact, the customers who visited the booth today included Korea Southern Power Company, Korea Water Resources Corporation, and the military, which primarily use internal networks.
organisation Korea Water Resources Corporation
In fact, the customers who visited the booth today included Korea Southern Power Company, Korea Water Resources Corporation, and the military, which primarily use internal networks.
‎2026/10/08
CyberXero combined Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks.
organisation SQL
This also enables detection and blocking of various web attacks, including SQL injection, cross-site scripting (XSS), and other web attacks, as well as automated account attacks, such as credential spoofing and abnormal web and API requests, and attempts to exploit vulnerabilities.
organisation CTEM
Pyongyang has called for the use of AI-based countermeasures in response to cyber attacks, citing the need for the CTEM (Cyber Threat Emergency Management) system.. Financial Sector Cybersecurity Threat Response Strategy Guidance Introduction to 'Blue Hunter', AI-based CTEM System Implementation Combining WAF 'Web Front-K' and Security Monitoring Service for Ongoing Detection and Response Supp…
organisation Cyber Threat Emergency Management
Pyongyang has called for the use of AI-based countermeasures in response to cyber attacks, citing the need for the CTEM (Cyber Threat Emergency Management) system.. Financial Sector Cybersecurity Threat Response Strategy Guidance Introduction to 'Blue Hunter', AI-based CTEM System Implementation Combining WAF 'Web Front-K' and Security Monitoring Service for Ongoing Detection and Response Supp…
organisation Security Monitoring Service for
Pyongyang has called for the use of AI-based countermeasures in response to cyber attacks, citing the need for the CTEM (Cyber Threat Emergency Management) system.. Financial Sector Cybersecurity Threat Response Strategy Guidance Introduction to 'Blue Hunter', AI-based CTEM System Implementation Combining WAF 'Web Front-K' and Security Monitoring Service for Ongoing Detection and Response Supp…
organisation DataNet] PyoLink
[DataNet] PyoLink (Representative Cho Young-Chul) recently introduced an AI-based cybersecurity threat management platform 'Blue Hunter' to address the need for continuous threat exposure management (CTEM) in the financial sector to prevent incidents such as hacking.
organisation PyoLink
PyoLink's 'Blue Hunter' combines attack surface management and AI-based infiltration verification to implement the CTEM system.
organisation WebFront-K
"WebFront-K", an AI-powered automation tool, defends against web and API attacks.
organisation API
"WebFront-K", an AI-powered automation tool, defends against web and API attacks.
The company stated, “API authentication and access control must be strengthened, and expanding security checks on business support systems is crucial.”
organisation ARTEX
Pyriank is providing the WebFront-K signature to users to respond to ARTEX-related attacks, allowing users to detect and block requests that match the signature.
organisation WordPress
The Russian-speaking operator targeted WordPress and e-commerce sites worldwide while separately probing Ukrainian energy and utility organizations.
organisation CyberXero
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks.
organisation AI-Augmented Cyberattacks
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks.
organisation Cyber Security News
The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session […] The post CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks appeared first on Cyber Security News .
data_breach 90,000 files
The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session […] The post CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks appeared first on Cyber Security News .
organisation White Defender
Following recent incidents of ransomware infection at 20 small hospitals, the demand for White Defender has increased significantly.
organisation OctaCore
At this event, security firm OctaCore showcased a solution that leverages biometric authentication to restrict AI agents to only execute approved work only after administrator approval.
organisation Izhi Pingge'
For instance, if an AI agent requests a 5,000,000 won transfer, the administrator would verify the agent's identity and the transfer company, and then use the fingerprint scanner 'Izhi Pingge' to confirm the approval.
organisation Samsung Electronics
In reality, 'Izhi Pingge' has been adopted by major companies such as Samsung Electronics and major banks, including the first-tier bank, for internal work processing.
organisation Anrap
A representative from Anrap, a leading information security company, said, "AI has significantly increased the speed and productivity of attackers."
organisation XDR
The company also emphasized the importance of strengthening its integrated security operation system through the use of AI-based security monitoring and XDR (Extended Detection and Response).
Tactical Metrics
Metrics
data_breach
90,000
Files
The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session […] The post CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks appeared first on Cyber Security News .
Intelligence Sources
Security Affairs 2026-09-27
Security Affairs 2026-10-04
Chosun Economy 2026-10-06
AlienVault OTX 2026-10-07
Datanet 2026-10-08