This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| 2013 South Korea cyberattack | |
|---|---|
| Title | 2013 South Korea cyberattack |
| Date | 20 March 2013 |
| Location | South Korea |
| Targets | KFTC, Banks, KBS, MBC, YTN, KRX |
| Type | cyberattack, DDoS, Malware |
| Perpetrators | Unknown (accused: North Korea) |
| Motive | Disruption of South Korea infrastructure and Media services |
2013 South Korea cyberattack was a large-scale coordinated cyberattack on South Korea that occurred on 20 March 2013, disrupting major financial services, media outlets, and public institutions. The incident affected prominent entities including KFTC, multiple commercial banks such as Kookmin Bank, Shinhan Bank, and major broadcasters including KBS, MBC and YTN. International attention focused on attribution, involving agencies such as NIS, United States Cyber Command, Interpol, and analysts from Kaspersky Lab and Mandiant.
In the months prior to March 2013, tensions between South Korea and North Korea were elevated following incidents involving the Cheonan sinking and Bombardment of Yeonpyeong legacy disputes, as well as political shifts linked to the 2012 South Korean legislative election and the impending 2013 South Korean presidential election. Cybersecurity concerns had grown after earlier intrusions like the 2009 Distributed Denial of Service attacks on South Korea and malware campaigns affecting KAERI and private conglomerates such as Samsung and Hyundai. Academic institutions like KAIST and think tanks including the Asan Institute for Policy Studies had warned about vulnerabilities in South Korea's information infrastructure and the need to coordinate among agencies like the MND, MSIT, and KISA.
On 20 March 2013, at approximately 09:30 local time, multiple workstations at broadcasters KBS, MBC and YTN displayed fake defacement messages while telephone and online banking services at institutions like Kookmin Bank, Shinhan Bank, and Hana Bank were rendered inoperable. The attack used malware executed through removable media and scripting that erased master boot records and corrupted files, similar to techniques observed in earlier incidents such as Stuxnet and later compared with Shamoon. Automated scripts affected servers at the KRX and disrupted electronic payments processed by the KFTC. Response teams from affected companies, national Computer Emergency Response Teams like KISA-CERT, and specialists from Samsung SDS and LG CNS began containment and recovery operations. Throughout the day, televised broadcasts were interrupted, online portals displayed images accusing South Korea of censorship and referencing North Korea, and firms implemented contingency plans involving offline transaction processing and manual operations.
Initial attribution was contested. The NIS and officials pointed to methods consistent with operations originating in North Korea, citing overlaps with prior attacks and ballistic of signatures used in state-sponsored campaigns. External cybersecurity firms including Kaspersky Lab, Mandiant, Symantec, and ESET conducted forensic analysis of malware samples, command-and-control infrastructure, and binary code similarities. International bodies such as Interpol and the United States Cyber Command offered investigative assistance. Independent researchers compared code characteristics to campaigns like DarkSeoul and malware families observed in Eastern Europe intrusions. Legal investigators from the Supreme Prosecutors' Office of the Republic of Korea coordinated evidence collection, digital forensics, and international mutual legal assistance with agencies including the FBI and NCSC.
The attack affected millions of customers, temporarily disabling online and telephone banking at Kookmin Bank, Shinhan Bank, Hana Bank, and others, disrupting clearing services at the KFTC and trading operations at the KRX. Major broadcasters KBS, MBC and YTN experienced on-air disruptions and data loss. Economic analyses by institutions such as the Bank of Korea and private consultancies estimated direct and indirect losses through interrupted transactions, reputational damage, and recovery costs. Critical infrastructure sectors monitored by agencies like MOHW and MOLIT were prompted to reassess incident response. Insurance firms including Korean Re examined cyber insurance exposures. The incident highlighted supply-chain risks involving vendors like AhnLab and Hancom.
Immediate measures included isolation of infected networks, restoration from backups, deployment of patch management and enhanced endpoint protection by vendors such as AhnLab, engagement of private firms like Samsung SDS for recovery, and activation of emergency committees at the Blue House and NSC. The MSIT and KISA issued alerts and coordinated with multinational partners including United States Cyber Command and NISC. Financial institutions used contingency protocols and fallback systems to resume operations; broadcasters migrated to redundant playback systems. Subsequent security hardening included stricter removable media policies, enhanced network segmentation, mandatory incident reporting, and investment in national Computer Security Incident Response Team capacity at KISA. Academic collaboration with Seoul National University and Yonsei University provided research into malware behavior and detection.
The attack accelerated legislative and regulatory changes involving PIPC guidelines, amendments to the Network Act, and discussions in the National Assembly on cybersecurity readiness. Debates engaged stakeholders including MOJ prosecutors, private sector representatives from Korea Federation of Banks and KCC, and civil society actors such as the Korea Internet Corporative. Proposals included mandatory breach notification requirements, establishment of an expanded national cyber command under the MND, and frameworks for public-private information sharing modeled after DHS initiatives. International law discussions involved the Tallinn Manual debates and attribution standards for state responsibility.
Foreign governments including the United States, Japan, European Union, and multiple NATO cybersecurity partners expressed concern and offered investigative or technical assistance through channels such as Interpol and bilateral cybersecurity dialogues. Multinational firms including Microsoft, Cisco Systems, and FireEye provided advisory support. Regional security forums like the ASEAN Regional Forum and the Asia-Pacific Economic Cooperation discussed implications for critical infrastructure resilience. The incident prompted acceleration of multinational exercises and cooperation on cyber norms through venues including the United Nations General Assembly cybercrime panels and the Budapest Convention on Cybercrime dialogue.
Category:Cyberattacks in South Korea Category:2013 in South Korea Category:Information security incidents