Loading story…
South Korea faced repeated large-scale cyberattacks that disrupted banks, broadcasters, and government-facing online services, with incidents ranging from distributed denial-of-service activity against public websites to destructive attacks that knocked out internal computer networks. In one wave, attackers targeted major South Korean institutions including a leading bank, a national newspaper, and the country’s intelligence service, while related attacks also hit U.S. government websites such as the White House, Pentagon, and State Department. Officials described those operations as primarily disruptive to public-facing services rather than breaches of internal systems.
In a later major incident, computer networks at broadcasters KBS, MBC, and YTN, along with Shinhan Bank and Nonghyup, were crippled, interrupting ATMs, payment terminals, and mobile banking even as television broadcasts remained on air. South Korean authorities raised cyber alert levels, sent investigative teams, and increased military cyber readiness amid heightened regional tensions and longstanding concern over North Korea’s cyber capabilities, though officials said attribution remained unconfirmed and warned that identifying the true source could take months; some compromised machines reportedly displayed messages from a group calling itself "WhoisTeam."
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Following the March 2013 disruption, authorities raised the national cyber alert level, dispatched investigative teams, and increased military cyber readiness while investigating the cause of the attack.
Computer systems at broadcasters KBS, MBC, and YTN and banks Shinhan and Nonghyup were disrupted in a suspected cyberattack, affecting ATMs, payment terminals, and mobile banking while television broadcasts remained on air. Some compromised machines displayed messages from a group calling itself 'WhoisTeam,' though attribution was not established.
In response to the 2009 attacks, South Korea said it would speed up plans to establish a cyber warfare unit to improve its ability to counter similar incidents.
By the third day of the 2009 campaign, suspected coordinated attacks were targeting additional South Korean sites including a major bank, a leading newspaper, and the national intelligence service. Officials said the attacks were disruptive to websites rather than internal systems, and no evidence had confirmed speculation of North Korean involvement.
A wave of denial-of-service attacks began earlier in the week, disrupting public-facing websites in both the United States and South Korea, including U.S. government sites such as the White House, Pentagon, and State Department.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcenytimes.com
Open sourceweb.archive.org
Open sourcenews.bbc.co.uk
Open sourcenews.bbc.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research tracing the **DarkSeoul** threat cluster has linked the 2014 Sony Pictures Entertainment breach to a longer-running campaign of destructive intrusions that also hit South Korean banks and media companies. The reporting ties the activity to malware families and operational patterns seen across incidents dating back to at least 2009, including the April 2013 **DarkSeoul** attack that crippled tens of thousands of systems with disk-wiping malware. Analysts said the campaign was initially mistaken in some cases for hacktivism, but code lineage, shared tooling, and recurring tradecraft pointed to a coordinated, multi-year operation. The Sony intrusion malware **Destover** was highlighted as part of the same evolving toolkit, with researchers connecting it to broader destructive and espionage activity primarily targeting South Korean organizations across sectors. One analysis said South Korean authorities independently attributed the 2013 attacks to **North Korea**, while another noted that the operators behind the wider cluster were commonly tracked as **DarkSeoul** or **Silent Chollima**, though exact operator identity remained disputed in some reporting. The studies also outlined indicators of compromise and defensive controls that could have reduced the impact of the wiper attacks.
Aug 15, 2026
South Korean authorities and AhnLab disclosed **Operation Double Barrel**, a campaign that targeted Korean citizens and businesses from 2025 through the first half of 2026 by exploiting vulnerabilities in Korean financial security software. The activity used **watering hole** and **spear-phishing** attacks to direct victims to malicious URLs, after which attackers deployed backdoors including **Struggle** (also tracked as `SIGNBT 3.0`) and **Brandoor** (`COPPERHEDGE`). Legitimate Korean websites in media, education, healthcare, and manufacturing were abused as part of the watering hole infrastructure, and investigators said the pattern also raised possible **supply-chain** concerns tied to a shared website development and management company. The same software flaws were also used in separate intrusions that delivered **Gunra ransomware**, leading to file encryption and data exfiltration. A joint cybersecurity advisory issued by South Korea's **National Intelligence Service**, **National Police Agency**, **Korea Internet & Security Agency**, and **Financial Security Institute** said overlapping vulnerabilities, malware characteristics, SSH key fingerprints, and network infrastructure indicate possible limited collaboration or shared tooling between a state-sponsored threat actor and the Gunra ransomware group, although the relationship has not been confirmed definitively.
Aug 3, 2026
Palo Alto Networks' Unit 42 reported increased activity from the **KRBanker** banking trojan, also known as **Blackmoon**, targeting financial institutions in South Korea. The malware was delivered through the **KaiXin exploit kit** and the **NEWSPOT** adware program, using Adobe Flash flaws `CVE-2014-0569` and `CVE-2015-3133` to infect victims. Once executed, KRBanker used **process hollowing** and contacted command-and-control infrastructure after pulling pharming server information from **Qzone** profile nickname fields. Rather than relying on a traditional man-in-the-browser approach, KRBanker manipulated victims through **pharming**, redirecting traffic for selected Korean banks to fraudulent sites while legitimate URLs could still appear in the browser. The malware also abused Windows **Proxy Auto-Config** settings to steer banking traffic, stole digital certificates from the `NPKI` directory, and was capable of terminating **AhnLab V3** security software, increasing the risk of credential theft and fraudulent banking transactions.
Jun 29, 2026