Numerous North Korean IPs Detected in Hacking Attempts Targeting Financial Sector; Authorities Urge Extreme Caution

A large volume of access attempts originating from North Korean internet protocol (IP) address ranges has been detected in hacking attempts targeting the financial sector.

This is the first time that North Korean IP attacks have been officially confirmed since a hacking incident in the financial sector became known earlier this month.

According to the financial industry today (October 28), financial authorities shared an official document on October 21 with financial institutions, including cryptocurrency exchanges, through the integrated financial security control system "FIRST," containing "notice regarding scan-type access targeting the financial sector from North Korean IPs."

The authorities stated that starting from 3:00 a.m. on October 21, a massive number of circumstances were detected in which multiple North Korean IPs continuously attempted scan-type access targeting the financial sector.

Scan-type access refers to the act of attempting connection to identify vulnerabilities in specific systems or open network ports.

In other words, it is an approach to figure out if there are any gaps in security.

The IP identified by the authorities is 175.45.[176].0/22, and a large portion of this range belongs to North Korea.

As of the time the official document was sent, the number of detected access attempts reached approximately 4,404,101.

The authorities requested that related matters, such as information protection, internal controls, and real-time monitoring for detecting abnormal signs, be inspected and necessary measures be taken.

They also asked institutions to check the access history of the relevant North Korean IPs and contact the authorities if any unusual activities are discovered.

However, it is reported that there have been no cases reported where attack attempts through these IPs led to actual security breaches and caused damage so far.

There are also many observations that it is difficult to jump to the conclusion that attacks through North Korean IPs are necessarily the work of North Korean hackers.

An official from the authorities said, "Since IP nationalities can be manipulated, it is difficult to pinpoint the nationality of hackers based solely on IPs."

In a media notice on October 6, when hacking incidents in the financial sector occurred successively, the Financial Supervisory Service explained, "In some cases, the country of origin for certain IPs cannot be determined, and even if a country is identified, caution is required in interpretation as circumvention is possible."

Meanwhile, the National Security Office of the presidential office is scheduled to hold an emergency response meeting this afternoon, chaired by 3rd Deputy Director Song Ki-ho, with officials from the Financial Services Commission.

At the meeting, plans are to check the scale of damage related to hacking incidents that occurred at cryptocurrency exchange Bithumb, Mirae Asset Global Investments, and others, and to discuss countermeasures to prevent the spread of additional damage.

(File Photo: Yonhap News)
※ Please note: This article was translated by AI and may contain errors.