Tools for Withdrawing Virtual Assets Found on Hacked Servers of Seven Domestic Financial Institutions

From late September to early October, tools capable of executing virtual asset withdrawal functions were discovered on servers associated with cyber attacks targeting domestic financial institutions. According to a report by cybersecurity firm Hunt.io, scripts with digital asset withdrawal and wallet information collection capabilities were identified within the attack infrastructure related to breaches of domestic financial institutions. The analysis revealed that an AI-based automated penetration tool named 'ARTEX' was utilized. Hunt.io confirmed the existence of additional servers located in Hong Kong and secured scripts and executable files that could be used for attacks from externally exposed server storage. The tools related to digital assets include 'x.js' and 'x.sh', where x.js checks the admin login status of the digital asset mining pool operation software YIIMP and includes withdrawal execution functions. x.sh is equipped with features for exploring servers related to digital asset wallets, supporting remote shell functionality and configuration file collection. If attackers gain access to the relevant services, they could exploit this to investigate wallet operating environments or collect information. The report stated that while tools related to digital assets and Linux vulnerability attack tools were discovered, no direct correlation with the breaches of domestic financial institutions was confirmed.