NICT warns of A2B attacks: an app can reveal the route to its server

A publicly available app can show attackers where and how to reach its server. Japan’s research institute NICT issued a warning about App-to-Backend attacks, or A2B, on 13 October 2026.

What researchers observed

NICT’s LETTICE team describes attackers analysing Android apps to discover server connections and interfaces, then tailoring attacks to the backend. NICT identifies this as one cause of recent data leaks in Japan, without attributing every incident to a shared campaign.

The important distinction is that the server can be the target even when the app contains no exploitable vulnerability. Initially, the app provides information about access.

Why backend controls remain decisive

The CYNEX technical warning highlights weaknesses including authentication, authorisation and input validation. It recommends checking for compromise, inspecting vulnerabilities and applying interim mitigations. NICT notes that similar problems can affect other app and web backends.

This is not an announcement of one Android vulnerability automatically resolved by an operating-system update. It concerns publicly analysable applications and the protection of their connected services.

Our view: assess the service behind the app

For companies, outsourced development makes this particularly relevant. Accepting an app requires a shared understanding of who operates its API, verifies access controls and responds to suspicious activity. A contract covering the interface does not automatically answer those questions.

Consider a simplified example: an app displays order records. The server must ensure that a signed-in user can retrieve only their own orders. Hiding a button in the app cannot replace that check.

This complements our coverage of the Japan cloud incident, but does not establish its intrusion route. The third-party risk guide covers the organisational responsibilities in outsourced development.