A Chinese internet address was the source of a cyber attack on one company hit in a massive network shutdown that affected 32,000 computers at six banks and media companies in South Korea, initial findings indicated Thursday.
It’s too early to assign blame — internet addresses can easily be manipulated and the investigation could take weeks — but suspicion for Wednesday’s shutdown quickly fell on North Korea, which has threatened Seoul and Washington with attack in recent days because of anger over UN sanctions imposed for its Feb. 12 nuclear test.
South Korean regulators said they believe the attacks came from a “single organization,” but they’ve still not finished investigating what happened at the other companies.
Experts say hackers often attack via computers in other countries to hide their identities. South Korea has previously accused North Korean hackers of using Chinese addresses to infect their networks.
“We do know that North Korea does route attacks through Chinese servers because that’s the only way they can communicate with South Korea,” Timothy Junio, a cyber security fellow at Stanford University’s Center for International Security and Cooperation, said. “It’s not surprising there’s a Chinese IP address involved.”
Seoul believes North Korea runs an internet warfare unit aimed at hacking U.S. and South Korean government and military networks to gather information and disrupt service.
The attack Wednesday caused computer networks at major banks and top TV broadcasters to crash simultaneously. It paralyzed bank machines across the country and raised fears that this heavily internet-dependent society was vulnerable. On Thursday, only one of the attacked banks, Shinhan, was fully online, officials said.