Many IP Addresses Used in 'Financial Sector Attacks' Are for Laundering... "Hacking Routes Under Investigation"

International Cooperation Underway
Significant Progress in Data Analysis

A significant number of the internet protocol (IP) addresses used in the widespread hacking attacks targeting the financial sector have been identified as "laundering" addresses designed to conceal the attackers’ tracks. Police are tracing the hacking routes based on international cooperation.

Multiple bank ATMs installed throughout Seoul city. Photo by Yonhap News Agency

According to the police on October 7, the Cyber Terror Investigation Unit of the National Police Agency confirmed that many of the 28 IP addresses associated with hacking incidents targeting financial institutions were used for laundering purposes. The remaining addresses are also being examined to determine if they served a similar function. A police official explained, "From the early stages of the investigation, there has been strong cooperation with related agencies, which is expediting the analysis."

The police launched a preliminary investigation (internal inspection) into the hacking incident against the financial sector on October 1, and following fact-checking procedures, the case was officially filed the previous day for alleged violations of the Information and Communications Network Act. The Cyber Terror Response Division at police headquarters was designated as the dedicated investigation team, led by the division chief, with four teams comprising 28 personnel assigned to the case.

This is the first major cyber incident since the implementation of amendments to the Criminal Procedure Act, which transformed the criminal justice system. Cyber investigations have long been a field where the police have accumulated significant experience and know-how based on their specialized workforce.

Additionally, the Financial Supervisory Service shared information on the 28 unique attack IP addresses—excluding duplicates—with the financial sector, along with certain country data, the previous day. However, even if the host countries are identified, it is still possible that the attackers used bypass connections. The police are therefore verifying whether such traces of proxy or bypass activity exist while continuing to trace the hacking routes. International cooperation necessary to verify information along the attack paths is already underway and may be expanded further as additional analysis is completed.

As of now, confirmed data breaches have occurred at Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, and within the secondary financial sector at Hyundai Capital, Yegaram Savings Bank, and Welcome Savings Bank. When the police began their internal investigation, the targets were primarily Shinhan Bank, KB Kookmin Bank, Hana Bank, and BNK Busan Bank. As the number of affected institutions has increased, the investigation is expected to expand as well.

Meanwhile, the police are also considering whether to notify the Major Crime Investigation Agency regarding this case. There are two types of cybercrimes that require such notification: violations of the Information and Communications Network Act due to hacking of national key infrastructure, and violations of the Electronic Financial Transactions Act involving hacking of electronic financial infrastructure. The affected financial institutions are not designated as critical national infrastructure. The Financial Services Commission has been asked for an authoritative interpretation on whether the incidents fall under the definition of electronic financial infrastructure. Regardless of the determination regarding jurisdiction or transfer, the investigation will continue.

This content was produced with the assistance of AI translation services.