Security · October 16, 2026
NICT identifies A2B attacks as cause of recent security breaches
On October 13, the National Institute of Information and Communications Technology (NICT) reported that it has identified part of the cause behind a series of security breaches affecting companies since late August. The attacks have been named "A2B (App-to-Backend Attack)" by NICT. According to NICT's threat information analysis team, LETTIC, A2B attacks involve analyzing publicly available APIs of Android applications to infiltrate backend servers. Even in the absence of vulnerabilities in the applications themselves, weaknesses in authentication, authorization, and input validation on the backend server can lead to unauthorized access and information leakage.
LETTIC has warned that the use of artificial intelligence may enhance the efficiency of app analysis and vulnerability discovery, increasing the risk that such attacks could impact more systems. The analysis revealed that A2B attacks primarily target four types of vulnerabilities: server-side request forgery (SSRF), remote code execution (RCE), SQL injection, and insecure direct object reference (IDOR).
NICT has called on providers of Android applications to conduct inspections, implement countermeasures, and adopt avoidance strategies. Furthermore, it has recommended that similar issues could arise with backend APIs of iOS applications and web services, urging providers to ensure appropriate security measures are in place.
The institute provided guidelines for verifying potential compromises and inspecting vulnerabilities in APIs and publicly accessible hosts. It emphasized the need to check access logs for suspicious activities, compatibility with known indicators of compromise (IoCs), and unusual API operations. Additionally, NICT urged that vulnerabilities such as improper authorization, authentication failures, SQL injections, and misconfigurations in cloud services should be prioritized for inspection.
To mitigate potential risks, NICT suggested temporary measures, including restricting access from abroad or questionable sources, halting unnecessary public APIs, and monitoring API usage patterns. If leakage or misuse of authentication tokens is suspected, immediate invalidation or reissuance should be performed. In cases of confirmed vulnerabilities, prompt remediation is essential, and if immediate fixes are not feasible, consideration should be given to temporarily suspending affected APIs or services.