SEOUL, South Korea A Chinese Internet address was the source of a cyberattack on one company that was hit during a shutdown that affected 32,000 computers at six South Korea banks and media companies, initial findings showed today.
It's too early to assign blame – Internet addresses can easily be manipulated – but suspicion for Wednesday's shutdown fell on North Korea, which has recently threatened Seoul and Washington with attack because of anger over U.N. sanctions imposed for its Feb. 12 nuclear test.
South Korean regulators said they believe the attacks came from a “single organization,” but they've not finished investigating what happened at the other companies.
Experts say hackers often attack via computers in other countries to hide their identities. South Korea has previously accused North Korean hackers of using Chinese addresses to infect networks.
Seoul believes the North runs an Internet warfare unit aimed at hacking U.S. and South Korean networks for information and to disrupt service.
Wednesday's attack caused computer networks at major banks and top TV broadcasters to crash simultaneously. It paralyzed bank machines and raised fears that this heavily Internet-dependent society was vulnerable. Today, only one of the attacked banks, Shinhan, was fully online.
A Chinese address created the malicious code in the server of Nonghyup bank, according to an initial analysis by the state-run Korea Communications Commission, South Korea's telecom regulator.
Investigators are analyzing the login records and the malicious code. It could take at least four to five days for the infected computers to recover fully. Experts say the entire investigation could take weeks.