North Korean IP addresses linked to 4.4 million attempts to probe South's financial system
Financial authorities urged banks, cryptocurrency exchanges and other firms to strengthen monitoring after detecting suspicious scanning activity, though no breach or losses have been confirmed.
Automatic teller machines of South Korean commercial banks are installed in Seoul on Oct. 14.
NEWS1
South Korean financial authorities warned banks and financial firms to remain on high alert after detecting some 4.4 million suspicious attempts to access financial systems from North Korean internet protocol (IP) addresses as of mid-October.
It marks the first official confirmation that North Korean IP addresses were used to access South Korean financial systems after a wave of hacking attempts at Shinhan, KB Kookmin and Hana banks between late September and early October.
Financial authorities warned financial institutions, including cryptocurrency exchanges, of suspicious scanning activity originating from North Korean IP addresses in a notice issued through the integrated security monitoring system on Oct. 21.
Authorities said they had detected a large number of scanning attempts from multiple North Korean IP addresses beginning at 3 a.m. on the day the notice was issued.
Scanning involves attempts to identify vulnerabilities in computer systems or discover open network pathways that could provide an entry point for cyberattacks.
The suspicious activity originated from the IP range 175.45.[176].0/22, much of which is associated with North Korea. Authorities recorded about 4.4 million access attempts by the time they issued the notice.
However, no cases have been reported in which the attempts resulted in a confirmed security breach or financial damage.
Authorities urged financial institutions to review their cybersecurity safeguards, internal controls and real-time monitoring systems for suspicious activity and to take any necessary preventive measures. They also asked institutions to check their records for access attempts from the identified North Korean IP addresses and report any unusual findings.
Some cybersecurity observers cautioned that activity traced to North Korean IP addresses does not necessarily mean North Korean hackers were responsible.
"Some IP addresses cannot be traced to a specific country," the Financial Supervisory Service said on Oct. 6, when South Korean commercial banks were hit by cyberattacks. "Even when a country can be identified, attackers may have routed their traffic through other locations, so the findings should be interpreted with caution."
The presidential Office of National Security is scheduled to hold an emergency meeting with officials from the Financial Services Commission on Wednesday afternoon, chaired by Song Ki-ho, the third deputy national security adviser.
Officials plan to assess the extent of damage from recent hacking incidents involving cryptocurrency exchange Bithumb and Mirae Asset Global Investments and discuss measures to prevent further breaches.
BY KIM JI-HYE [[email protected]]
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
