South Korea blames North Korea for cyberattacks

South Korean officials have stated that North Korea is to blame for attacks against government websites last month, citing North Korean IP addresses and signature malicious computer codes as evidence. In addition, they say the same group of attackers are also responsible for the attacks last March.

The South Korean Ministry of Science have said that the North was responsible for a series of attacks in June, which started on the 63rd anniversary to the start of the Korean War. The attacks targeted 69 organizations, including South Korean media and government websites. Among the government websites hit by the raid were those used by the South Korean President and Prime Minister.

While primarily DDoS attacks, some websites were defaced and there have been claims by local media that data was taken. As of Tuesday evening, North Korea remained silent on the accusal, but in the past they have consistently denied any involvement in cyberattacks against the South.

[4 factors for avoiding cyber espionage attacks ]

In addition to the attacks in June, investigators also claimed to have discovered evidence that the same group of attackers were responsible for the attacks in March, which infected more than 48,000 systems, and led to hardware destruction after the master boot records on some of those systems, many of them in the banking industry, were wiped.

Chun Kilsoo, director of South Korea’s Internet Security Center, told reporters in a briefing on Tuesday that all of the evidence points to North Korea as the perpetrator of both attacks, and that they were planned months in advance. Chun added that the attackers aimed to steal personal information during the attacks in June, but could not comment on if the data was allegedly stolen during the planning process or during the DDoS attacks themselves.

Part of the evidence used to support the claim that the attackers were responsible for the attacks in March as well as the ones in June center on IP addresses. While IP addresses can be spoofed, and are often discounted as evidence, Chun said that because the discovered IP addresses were used to both send and receive data, they could not have been forged.

Moreover, the attackers in June used codes that had the same characteristics and features as the codes used during the attacks in March, which investigators say shows proof that they are one in the same.

Earlier this month, security vendor McAfee examined the March attacks and suggested that they were actually the end of a much larger campaign, which focused on espionage. McAfee also noted that it was highly likely that the attacks in March were linked with the ones in June.