[Edaily Reporter Lim Yukyung ] Amid confirmation of a recent large-scale cyberattack attempt targeting the financial sector originating from a North Korean IP address range, it has been determined that the attack likely did not actually originate in North Korea but was the result of a third party misusing North Korean IP addresses.

Based on a comprehensive review of E-Daily’s reporting on the 29th, it was confirmed that financial authorities are leaning toward the possibility that the scanning-type access recently detected from the North Korean IP range did not originate from actual packets (communication signals) sent from North Korea.

According to financial authorities and the financial sector, a large-scale scanning attack involving approximately 4.4 million instances originating from a North Korean IP range was detected around 3:00 a.m. on the 21st. Scanning is the act of searching for open ports or security vulnerabilities on a target server and serves as preliminary reconnaissance for hacking. The Korea Financial Security Institute and the Financial Supervisory Service sent an urgent security alert to the financial sector at 9:00 a.m. that same day, urging caution. The scanning activity reportedly lasted for about a day before ceasing.

As news of the attack emerged belatedly, public anxiety appears to be growing. This comes amid a series of hacking incidents over the past month—ranging from the banking sector to the financial investment industry—that have resulted in personal data leaks, coupled with ongoing speculation that some of these hacking attempts may have been orchestrated by North Korea.

However, financial authorities are reportedly leaning toward the possibility that the attack packets did not actually originate from North Korea, but were the work of a third party exploiting North Korean IP addresses. According to security experts familiar with the matter, analysis of the actual packets revealed clues suggesting that North Korean IP addresses were exploited.

Internet communication typically follows the sequence “connection request → response to the request → acknowledgment of the response,” but at the time, packets from North Korean IP addresses consistently consisted only of the “response to the request”—corresponding to the second stage—rather than the initial “connection request.” This suggests the possibility that a third party forged the financial companies’ IP addresses as the source to request a connection to North Korea, causing North Korea’s response to be routed back to the financial companies. In other words, even if the packets arriving at the financial institution were stamped with a North Korean IP address, the actual entity behind the attack could have been someone else. The fact that major websites in North Korea were also paralyzed by hacking attacks on the 21st—the day the attack occurred—is cited as circumstantial evidence supporting the possibility that North Korean IP addresses were exploited by a third-party attacker.

An official from the financial authorities explained, “Although the source IP address of the packets was shown to be in North Korea, it is highly likely that the IP address was exploited,” adding, “Since IP addresses are easy to spoof, we cannot conclusively identify the attacker based on the IP address alone.” This is why experts are pointing out that we should await announcements from investigative agencies regarding the identity of those behind the attack and focus on developing countermeasures against emerging security threats, such as artificial intelligence (AI).

Experts are urging that response capabilities be focused on eliminating security blind spots, such as unmanaged systems and services. Kim Seung-ju, a professor at Korea University’s Graduate School of Information Security, said, “Eliminating security blind spots through a comprehensive asset survey was included as a key task in the ‘Comprehensive Inter-Ministerial Information Security Plan’ announced by the government last October,” adding, “We need to verify how well the measures were implemented on the ground and, if they were not properly implemented, identify the reasons why.” He further emphasized, “As AI-powered vulnerability scanning and hacking become widespread, unmanaged assets can become targets for attackers,” adding, “Identifying and managing assets is the most urgent task to address in the era of AI hacking.”

Meanwhile, with additional security breaches occurring at Daishin Securities, Mirae Asset Management, and Bithumb, the total number of financial institutions that have suffered personal information leaks due to hacking in the past month has risen to 20. At Daishin Securities, the personal and credit information of 38,490 customers was leaked, and it was previously confirmed that the information of 25,729 customers was leaked at Shinhan Bank.