South Korea on High Alert After North Korean IP-Linked Scans Target Financial Sector

South Korean financial institutions were once again warned against potential cybersecurity attacks attributed to a North Korean IP address. No security breaches were reported, but the activity is a cause for alarm. South Korea's cybersecurity is on high alert for potential attacks, especially from North Korea, given its history of recorded attacks.

A group of North Korean IP addresses conducted an alarming number of vulnerability scans, particularly against its financial institutions. According to SBS News (translated), “since 3 am on the 21st, several North Korean IPs have continuously attempted to conduct a scan of the financial sector, and the situation has been widely detected.” Specifically, the IP Address block 175.45.176.0/22 was attributed to the vulnerability scan.

Scanning for Vulnerabilities and Source of Attacks

As of this writing, no financial institution has reported a data breach. Fortunately, security experts detected the scan before any actual attacks were conducted. Vulnerability scanning is virtually the first step in any cyber-attack, especially on financial institutions. Because of their multiple security protocols, hackers scan for vulnerabilities they can exploit.

It’s also important that a North Korean IP address block does not necessarily mean it came from North Korea. Although North Korea has a long history of cyberattacks, hackers from any country can route their attacks through different IP addresses, making attribution difficult. North Korea has a hand in multiple cyber attacks on the following South Korean institutions with serious consequences:

●    2016 Defense Data Theft - 236 GB of plans and documents stolen, including security information and agreements between the US and South Korea. Information and plans such as F-16 Data, drones, and Kim Jong-un assassination were stolen.

●    2018 Defector Data - North Korean hackers successfully stole more than 1,000 personal records of North Korean defectors.

●    2024 Lazarus - Lazarus, the notorious North Korean hacker group, has planted numerous malicious codes in South Korean defense companies intending to steal data.

●    2026 PHP Vulnerability - South Korea reported an attack related to the PHP2Shell vulnerability by suspected North Korean hackers. The country is also experiencing accelerated attacks from North Korea due to AI-assisted vulnerability analysis.

North Korean hackers have also been linked to cyberattacks in other countries and against major companies, including Bangladesh Bank, Sony Pictures, and the Axie Infinity/Ronin Network. These attacks have resulted in billions of dollars in financial losses worldwide. Sony Pictures was forced to halt the wide release of “The Interview” as hackers have reportedly threatened the company with additional attacks.

Scanning Activities and Advisory

According to Korea JoongAng Daily, an estimated “4.4 million attempts” were made against South Korean financial institutions. The massive number of attempts suggests extensive scanning to identify and track potential vulnerabilities. The scan has put financial institutions on high alert, prompting them to review their security protocols, especially those involving external network connections.

The South Korean government is also planning a meeting with relevant financial and security agencies to coordinate its response. Besides the recent scanning attempts, the meeting is also expected to address cryptocurrency-related security breaches affecting South Koreans.