The Threat Intelligence Analysis Team “LETTICE” at the National Institute of Information and Communications Technology (NICT) has identified a method—targeting the backend servers to which applications connect—as one of the causes behind a series of information leaks in Japan.
This technique exploits insights gained from analyzing publicly available Android applications and is commonly referred to as an “App-to-Backend (A2B) attack.”
In an A2B attack, the perpetrator acquires and analyzes an application to determine the servers it communicates with and the mechanisms (APIs) used for that communication, subsequently launching an attack tailored to the specific target server.
For the businesses providing these applications, this means that internal server specifications—which should remain confidential—are exposed, allowing attackers to exploit vulnerabilities within their systems. This, in turn, can lead to the leakage of sensitive data, such as personal information.
There is growing concern that the use of AI—which streamlines the process of analyzing applications and discovering vulnerabilities—could lead to the spread of such attacks across a wider range of systems.
NICT has provided an explanation of the specific methods used in A2B attacks and the vulnerabilities they target. Furthermore, the institute offers recommendations for businesses that publish Android applications, including steps for “verifying potential compromises,” “inspecting for vulnerabilities,” and “implementing interim mitigation measures.”
Further details are available in the CYNEX Library (https://cynex.nict.go.jp/library/261013-01.html).

※Translating Japanese articles into English with AI