SEOUL (Reuters) - This week's cyber-attack on South Korean broadcasters and banks may not have originated in China after all as the IP address has been traced to one of the victim banks, the communications regulator said on Friday.
But it couldn't ruling anything out, it added.
Hackers on Wednesday brought down the networks of three broadcasters and two banks, initially seen as the work of North Korea using its vast army of "cyber-warriors" to cripple computer servers.
Officials in Seoul originally said they had traced the breach to a server in China, a country that has been used by North Korean hackers in the past.
North Korea has threatened to attack both South Korea and the United States after it was hit with further U.N. sanctions for its nuclear test in February.
But the Korea Communications Commission said closer investigation into the attack on NongHyup Bank showed the IP address was a virtual IP address used within the bank for internal purposes.
The IP address by coincidence matched an address registered in China, it said.
The regulator said it could not rule anything out. There were signs the malicious code used came through an overseas route and a single entity was likely responsible for the attack on all six targets.
Wednesday's attack hit the network servers of television broadcasters YTN, MBC and KBS, Shinhan Bank and NongHyup. South Korea's military raised its alert levels in response.
About 32,000 computers were hit, according to the South's state-run Korea Internet Security Agency, adding it would take up to five days to fully restore functions.
It took the banks hours to restore banking services. Damage to the servers of the TV networks was believed to be more severe, although broadcasts were not affected.
North Korea has in the past targeted South Korea's conservative newspapers, banks and government institutions.
The biggest hacking effort attributed to Pyongyang was a 10-day denial of service attack in 2011 that antivirus firm McAfee, part of Intel Corp, dubbed "Ten Days of Rain". It said that attack was a bid to probe the South's computer defenses in the event of a real conflict.
South Korean authorities said Woori Bank was also attacked on Wednesday but was not infected.
North Korea last week complained that its own websites had been hacked, blaming the United States.
(Reporting by Jack Kim and Ju-min Park; Editing by Nick Macfie)
Support HuffPost
Our 2024 Coverage Needs You
Your Loyalty Means The World To Us
At HuffPost, we believe that everyone needs high-quality journalism, but we understand that not everyone can afford to pay for expensive news subscriptions. That is why we are committed to providing deeply reported, carefully fact-checked news that is freely accessible to everyone.
Whether you come to HuffPost for updates on the 2024 presidential race, hard-hitting investigations into critical issues facing our country today, or trending stories that make you laugh, we appreciate you. The truth is, news costs money to produce, and we are proud that we have never put our stories behind an expensive paywall.
Would you join us to help keep our stories free for all? Your contribution of as little as $2 will go a long way.
Can't afford to donate? Support HuffPost by creating a free account and log in while you read.
As Americans head to the polls in 2024, the very future of our country is at stake. At HuffPost, we believe that a free press is critical to creating well-informed voters. That's why our journalism is free for everyone, even though other newsrooms retreat behind expensive paywalls.
Our journalists will continue to cover the twists and turns during this historic presidential election. With your help, we'll bring you hard-hitting investigations, well-researched analysis and timely takes you can't find elsewhere. Reporting in this current political climate is a responsibility we do not take lightly, and we thank you for your support.
Contribute as little as $2 to keep our news free for all.
Can't afford to donate? Support HuffPost by creating a free account and log in while you read.
Dear HuffPost Reader
Thank you for your past contribution to HuffPost. We are sincerely grateful for readers like you who help us ensure that we can keep our journalism free for everyone.
The stakes are high this year, and our 2024 coverage could use continued support. Would you consider becoming a regular HuffPost contributor?
Dear HuffPost Reader
Thank you for your past contribution to HuffPost. We are sincerely grateful for readers like you who help us ensure that we can keep our journalism free for everyone.
The stakes are high this year, and our 2024 coverage could use continued support. If circumstances have changed since you last contributed, we hope you’ll consider contributing to HuffPost once more.
Support HuffPostAlready contributed? Log in to hide these messages.