JPCERT/CC Finds AI-Assisted API Attacks Using APK Analysis and SSRF Testing
Summary
JPCERT/CC traced servers linked to attacks on organizations and web services, finding AI-assisted vulnerability scanning, APK analysis and API testing. A separate server contained web shells and EDR-evasion evidence; it was not directly linked to the attacks.
Key points
- JPCERT/CC said attackers used AI to scan for known vulnerabilities and attack systems through APIs.
- On one server, investigators found APK analysis evidence and a Python script apparently used to test APIs for SSRF.
- Another server contained APK files and tools for Android and Flutter app analysis, including jadx and Blutter.
- A separate server, not directly linked to the attacks, contained files targeting web applications, MySQL, Jenkins and email gateways, plus evidence of EDR evasion and suspected web shells.
- JPCERT/CC urged researchers to share findings and recommended server-side authorization, rate limiting, monitoring, protecting embedded secrets and restricting SSRF destinations.
- The article lists three IP addresses as indicators: 210.149.87[.]120, 118.26.36[.]16 and 69.10.51[.]162.
Article Details
- Attack Vectors
- Attackers used AI to scan for known vulnerabilities and conduct attacks via APIs.
- Attackers analyzed Android application packages to identify APIs and tested associated APIs for vulnerabilities, including server-side request forgery.
- A separate server contained evidence of attempts to evade EDR systems and web shells believed to have been deployed within a targeted network.
- Defensive Notes
- Do not embed private keys used for API authentication or long-lived credentials in applications.
- Enforce authentication and authorization on the server; do not rely solely on request-signing mechanisms or application code obfuscation.
- Apply rate limiting and monitor APIs for anomalous requests, including requests from clients other than the legitimate application.
- For APIs that retrieve content from external URLs, restrict accessible destinations and validate redirect destinations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 118[.]26[.]36[.]16 | Listed by JPCERT/CC in its attack-infrastructure investigation IoC appendix. |
| IPV4 | 210[.]149[.]87[.]120 | Listed by JPCERT/CC in its attack-infrastructure investigation IoC appendix. |
| IPV4 | 69[.]10[.]51[.]162 | Listed by JPCERT/CC in its attack-infrastructure investigation IoC appendix. |
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers tested APIs for vulnerabilities, including SSRF, and carried out attacks via APIs.T1505.003 · Web ShellThe article reports web shells believed to have been deployed within a targeted network.T1595.002 · Vulnerability ScanningJPCERT/CC reports that attackers used AI to scan for known vulnerabilities.
Tools
Blutterserver under investigation, we found several APK files, along with files associated with two tools: Blutter, used for reverse engineering Flutter applications, and jadx, used for analyzing Android applications.jadxwith files associated with two tools: Blutter, used for reverse engineering Flutter applications, and jadx, used for analyzing Android applications.