
Thousands of attack surfaces created by the 2025 IT ecosystem
In recent years, hacking attacks targeting companies and institutions have surged. As cloud work environments and AI technologies are used in practical work, the frequency of security incidents is increasing, and the methods of attack are becoming more sophisticated. According to the Korea Internet & Security Agency (KISA), the number of reported cyber threat incidents in Korea has increased by a whopping 48%, from 1,277 cases in 2023 to 1,887 cases in 2024.

In fact, when looking at the incidents sanctioned by the Personal Information Protection Commission over the past month, it was confirmed that more than 5 serious personal information leakage-related hacking incidents occur monthly.
Company | Hacking Details | Damage Scale and Leaked Information |
---|---|---|
B Company | The hacker attacked the website, causing personal information leakage | Leaked personal information of 342,253 customers (A total of 5 items were disclosed: name (nickname), gender, date of birth, mobile number, and address) |
K Company | Attempted hacking through malware on the server | Leaked personal information of employees |
D Company | Ransomware infection resulted in the shutdown of both the related company's website and the official website operated on the same server | - |
G Company | Credential stuffing attacks, where IDs and passwords are input randomly | Approximately 1.58 million instances of personal information leaked over a year: name, gender, date of birth, contact information, address, ID, email, marital status, anniversary, personal customs code, etc., totaling 10 items |
G Company | Multi-stage infiltration strategy to gain access to the target, | The company in charge of development, setup, and operation was hacked, resulting in a massive data theft |
N Company | Developed a core executable file that enables bypass access to a secure program using a private server | Damage of 23.8 million won |
S Company | Official Instagram account hacked due to ID theft, poor account management, lack of multi-factor authentication | - |
J Company | Need measures to prevent search companies from crawling sensitive documents managed online | One individual's resident registration form was publicly disclosed (address, mobile number, first part of resident registration number) |
D Company | Approximately 3,200 suspicious database query requests | - |
H Company | Ransomware attack | Encrypted personal information leaked (name, phone number, email, date of birth) |
….. |
Increasingly Sophisticated Hacks: A Competitive Edge?
In the past, a few security solutions like firewalls and antivirus software could maintain a certain level of security. However, as the IT environment rapidly evolves, attack surfaces are expanding and pathways of intrusion are becoming more sophisticated and varied, making organizations with insufficiently enhanced security easy targets. In particular, North Korean hacking groups, leading major security breaches, are found to employ the following three core attack techniques.
S/W Supply Chain Attacks – Hack into IT service and system integrators to infiltrate the internal systems of institutions and enterprises.
Exploitation of IT Solutions and Software Vulnerabilities – Perform tailored attacks that bypass or neutralize existing security solutions.
Utilization of Multiple IPs and Automated Scanning Tools – Continuously explore vulnerabilities and attempt penetration.
These attack techniques are familiar to security experts, but internal security personnel often find it challenging to perceive the specific progression of actual attacks and the severity of the threats. As a result, relying on simple vulnerability checks or automated scanning tools can lead to overlooking security gaps, which may eventually lead to serious breaches.
2024 Enki White Hat Top 5 Attack Techniques
The most effective way to proactively defend against security incidents is to identify vulnerabilities from the attacker's perspective and assess security status by considering penetration paths that attackers can realistically exploit. In other words, it's necessary to perform practical security testing, such as red team tests and penetration testing, through experts capable of understanding and utilizing creative attack techniques. In fact, by analyzing the penetration testing project conducted by NK WhiteHat in 2024, we can identify attack techniques similar to those used by actual attack groups, including North Korean hacking organizations.

Seizing legacy systems by exploiting unmanaged assets
Internal spreading through supply chain attacks
Exploiting 0-day vulnerabilities in management solutions for privilege escalation and internal spreading
Seizing older version services using 1-day vulnerabilities
Account theft through credential stuffing
Ultimately, thorough security management requires someone with the perspective of an attacker to move first and respond. Conducting security testing in the same way as actual hacking is the most realistic solution to prevent security incidents.
Is one to two pen tests a year enough?
Many companies conduct penetration tests once or twice a year regularly, yet hacking techniques evolve rapidly. As companies update services, the likelihood of new vulnerabilities increases. However, current penetration testing cannot address these vulnerabilities within the golden time.

Hacking attacks can occur at any time, 365 days a year
Hackers constantly look for weaknesses in company systems by developing new attack methods. They do not attack when the staff prefers. Because they penetrate the moment they spot vulnerabilities, a mock attack system must be continually operated to immediately respond to changes, like service updates.
Unnecessary paperwork for security personnel
If the process of planning new penetration testing projects, securing budgets, and obtaining approvals is repeated, unnecessary paperwork for the security team increases. A system that allows immediate testing whenever needed is essential to alleviate these inconveniences.
Closed communication without monitoring
The penetration testing conducted with existing services made it impossible for internal staff to transparently understand the process. Unless there are critical issues, vulnerabilities cannot be shared or addressed immediately. It was unclear how diligently the pentester performed penetration tasks. However, the security team must be aware of "what penetration testers are performing and how deep they have gone" first and understand penetration scenarios in real-time to quickly respond to vulnerabilities.
Therefore, the assurance that "we are safe today because there was no problem in the penetration testing conducted six months ago" cannot be guaranteed. Attack techniques continue to advance, new vulnerabilities emerge continuously, and the expertise of execution professionals also acts as a variable. Now is the time when a more sophisticated security management, continuous monitoring, and a system capable of real-time response are needed.
The era now demands subscription-based security
When a data breach occurs at a company, the first parties held responsible are, naturally, the security team members. Even if monitored 24/7, when an incident happens on an unforeseen path, the question often is, "Why didn't the security team know first?" For attackers, a single success is enough, whereas the security team faces an unfair situation where even one mistake is unacceptable.
The OFFen PTaaS service, provided by Enki WhiteHat, was created to alleviate this burden on security team members. It offers a penetration testing management dashboard for continuous management by white-hat hackers, going beyond the one-off penetration tests done 1-2 times a year. Unlike traditional penetration testing which involves ‘annual or biannual checks,’ OFFen PTaaS is a service where you can request monitoring and checks from white-hat hackers as needed.

Immediate testing available when needed
Without the traditional process of raising a proposal and securing a budget each time, you can start a project immediately using preloaded credits or a subscription model.
Monitor progress in real-time on the dashboard
You can know what tasks the pentesters are performing today. Additionally, the attack process which discovered specific vulnerabilities is visually verified through the MITRE ATT&CK framework. The security team can monitor the progress of the penetration testing in real-time and take immediate action on discovered vulnerabilities.
Smoother vulnerability response through issue reporting
In OFFen PTaaS, current issues are immediately shared and practical solutions are suggested. Instead of standardized scripts, custom code optimized for the corporate environment is developed and a PoC is provided.
Experience the know-how of white hackers

The effectiveness of penetration testing is fundamentally determined by the creativity and diligence of the professionals conducting the test. However, many penetration testing companies operate with a limited pool of personnel, often led by junior white hat hackers, resulting in either ongoing projects or formal assessments. This raises questions about whether the vulnerabilities identified pose truly critical threats or if proper assessments were conducted.
NKI WhiteHat is a company specializing in offensive security, with over 80% of its approximately 90 employees being technical staff, and over 50% consisting of white-hat hackers. Their penetration skills are exceptional, consistently ranking high in CTF competitions, and they have the expertise to design and manage CTF challenges. (Learn more about NKI WhiteHackers) This expertise is already trusted by many companies, and details can be seen in the recent LG U+ Blackbox Penetration Testing project. *(LG U+ article link) Thus, when NKI WhiteHat conducts penetration testing and red team services, they aim for a thorough security analysis from an actual attacker's perspective, identifying vulnerabilities and proposing the most realistic countermeasures.
OFFen PTaaS is a service developed to enhance the transparency and effectiveness of penetration testing and quickly derive solutions. While traditional penetration testing was conducted in a closed manner, OFFen PTaaS is designed to solve security issues in real-time communication with clients. PTaaS provides not only penetration testing but also vulnerability diagnostics and red team services. It detects potential security threats based on various attack scenarios optimized for corporate environments and provides solutions proactively.
Penetration testing is not just an inspection. It is an opportunity to learn the attack paths and vulnerability response methods that security teams may not be aware of. Through NKI WhiteHat's OFFen PTaaS, meticulously check security as needed and internalize the know-how of white hat hackers to enhance your company's security response capabilities.
Want to know how to reduce the workload of your security team and strengthen your company's security in real-time?

Popular Articles