pkg hancocks south korea hacking evidence_00005810.jpg
pkg hancocks south korea hacking evidence_00005810.jpg
Now playing
02:20
Dark Seoul: Do codes prove North Korea carried out hack?
CNN
Now playing
02:35
Photos show N. Korea improving nuclear facility
KCTV
Now playing
02:06
North Korea shakes up its military leadership
CNN
Now playing
02:51
CNN reporter's surreal journey inside N. Korea
Hyon Song-Wol (C), the leader of North Korea's popular Moranbong band, arrives at Seoul station in Seoul on January 21, 2018 before boarding a train bound for the eastern city of Gangneung.
North Korean delegates arrived in Seoul on January 21 on their way to inspect venues and prepare cultural performances for next month's Winter Olympics, in the first visit by Pyongyang officials to the South for four years. / AFP PHOTO / KOREA POOL / - / South Korea OUT        (Photo credit should read -/AFP/Getty Images)
-/AFP/AFP/Getty Images
Hyon Song-Wol (C), the leader of North Korea's popular Moranbong band, arrives at Seoul station in Seoul on January 21, 2018 before boarding a train bound for the eastern city of Gangneung. North Korean delegates arrived in Seoul on January 21 on their way to inspect venues and prepare cultural performances for next month's Winter Olympics, in the first visit by Pyongyang officials to the South for four years. / AFP PHOTO / KOREA POOL / - / South Korea OUT (Photo credit should read -/AFP/Getty Images)
Now playing
02:44
Who is North Korean pop star Hyon Song Wol?
north korea kim jung un new year speech hancocks lklv_00005209.jpg
Korean Central TV
north korea kim jung un new year speech hancocks lklv_00005209.jpg
Now playing
02:20
Kim Jong Un delivers New Year's address
Now playing
00:49
North Korea's largest textile factory
Now playing
00:51
Communal living in Pyongyang
Now playing
01:01
A glimpse of life in Pyongyang
This undated picture released from North Korea's official Korean Central News Agency (KCNA) on September 16, 2017 shows North Korean leader Kim Jong-Un (R) inspecting a launching drill of the medium-and-long range strategic ballistic rocket Hwasong-12 at an undisclosed location.
Kim vowed to complete North Korea's nuclear force despite sanctions, saying the final goal of his country's weapons development is "equilibrium of real force" with the United States, state media reported on September 16.  NK leadership watch says:  Kim Jong Un watches a missile drill on September 15, 2017. Also in attendance behind him are Kim Jong Sik and Ri Pyong Chol (Photo: KCNA).
STR/AFP/AFP/Getty Images
This undated picture released from North Korea's official Korean Central News Agency (KCNA) on September 16, 2017 shows North Korean leader Kim Jong-Un (R) inspecting a launching drill of the medium-and-long range strategic ballistic rocket Hwasong-12 at an undisclosed location. Kim vowed to complete North Korea's nuclear force despite sanctions, saying the final goal of his country's weapons development is "equilibrium of real force" with the United States, state media reported on September 16. NK leadership watch says: Kim Jong Un watches a missile drill on September 15, 2017. Also in attendance behind him are Kim Jong Sik and Ri Pyong Chol (Photo: KCNA).
Now playing
02:33
Inside story of N. Korean smuggler's paradise
Now playing
00:56
The home of a North Korean Workers' Party member
A North Korean defector darts across the DMZ dividing the two Koreas in this screenshot of handout video provided by the United Nations Command.
United Nations Command
A North Korean defector darts across the DMZ dividing the two Koreas in this screenshot of handout video provided by the United Nations Command.
Now playing
03:05
Video shows North Korean defector's escape
North Korean soldiers (R) look at the South side while US Vice President Mike Pence (not pictured) visits the truce village of Panmunjom in the Demilitarized Zone (DMZ) on the border between North and South Korea on April 17, 2017.
Pence arrived at the gateway to the Demilitarised Zone dividing the two Koreas, in a show of US resolve a day after North Korea failed in its attempt to test another missile. / AFP PHOTO / JUNG Yeon-Je        (Photo credit should read JUNG YEON-JE/AFP/Getty Images)
JUNG YEON-JE/AFP/AFP/Getty Images
North Korean soldiers (R) look at the South side while US Vice President Mike Pence (not pictured) visits the truce village of Panmunjom in the Demilitarized Zone (DMZ) on the border between North and South Korea on April 17, 2017. Pence arrived at the gateway to the Demilitarised Zone dividing the two Koreas, in a show of US resolve a day after North Korea failed in its attempt to test another missile. / AFP PHOTO / JUNG Yeon-Je (Photo credit should read JUNG YEON-JE/AFP/Getty Images)
Now playing
01:40
What it's really like to be inside North Korea
Kim Yo Jong, the youngest sister of North Korean leader Kim Jong Un, seen in March 2014.
KCNA via Getty Images
Kim Yo Jong, the youngest sister of North Korean leader Kim Jong Un, seen in March 2014.
Now playing
02:14
Kim Jong Un promotes his sister (2017)
This undated picture released from North Korea's official Korean Central News Agency (KCNA) on October 29, 2017 shows North Korean leader Kim Jong-Un (C) inspecting the Pyongyang Cosmetics Factory, as his wife Ri Sol-Ju (R) looks on. / AFP PHOTO / KCNA VIA KNS / STR / South Korea OUT / REPUBLIC OF KOREA OUT   ---EDITORS NOTE--- RESTRICTED TO EDITORIAL USE - MANDATORY CREDIT "AFP PHOTO/KCNA VIA KNS" - NO MARKETING NO ADVERTISING CAMPAIGNS - DISTRIBUTED AS A SERVICE TO CLIENTS
THIS PICTURE WAS MADE AVAILABLE BY A THIRD PARTY. AFP CAN NOT INDEPENDENTLY VERIFY THE AUTHENTICITY, LOCATION, DATE AND CONTENT OF THIS IMAGE. THIS PHOTO IS DISTRIBUTED EXACTLY AS RECEIVED BY AFP.  /         (Photo credit should read STR/AFP/Getty Images)
STR/AFP/Getty Images
This undated picture released from North Korea's official Korean Central News Agency (KCNA) on October 29, 2017 shows North Korean leader Kim Jong-Un (C) inspecting the Pyongyang Cosmetics Factory, as his wife Ri Sol-Ju (R) looks on. / AFP PHOTO / KCNA VIA KNS / STR / South Korea OUT / REPUBLIC OF KOREA OUT ---EDITORS NOTE--- RESTRICTED TO EDITORIAL USE - MANDATORY CREDIT "AFP PHOTO/KCNA VIA KNS" - NO MARKETING NO ADVERTISING CAMPAIGNS - DISTRIBUTED AS A SERVICE TO CLIENTS THIS PICTURE WAS MADE AVAILABLE BY A THIRD PARTY. AFP CAN NOT INDEPENDENTLY VERIFY THE AUTHENTICITY, LOCATION, DATE AND CONTENT OF THIS IMAGE. THIS PHOTO IS DISTRIBUTED EXACTLY AS RECEIVED BY AFP. / (Photo credit should read STR/AFP/Getty Images)
Now playing
03:08
Kim Jong Un's wife makes rare public appearance
KCTV
Now playing
00:44
Watch: N. Korea performance shows US in flames

Story highlights

South Korean investigators say they have proof that North Korea is launching cyberattacks

Reports say the North is investing heavily in digital warfare

December attack on banks in South Korea caused about $820 million worth of damage, a report says

Seoul, South Korea CNN —  

On March 20, 2013, a cyberattack brought chaos to several banks and media outlets in South Korea.

Then more ominously on December 23 last year, computers at the country’s nuclear operator were breached. Again cybercrime was suspected.

The source of these attacks? North Korea. And South Korean investigators say they have proof – the actual malicious codes used in the attacks. They shared this data with CNN.

The 2013 attack, known as “Dark Seoul,” paralyzed an estimated 48,000 computers at a number of major banks and broadcasters, disrupting network systems and wiping their hard disks clean.

“It would try to delete essentially all your files… then restart the system. You would come back up and nothing would be there,” Joshua James, a digital forensic expert, told CNN.

“If it infected more financial systems, it could have deleted all financial data in Korea. I mean, it is dangerous,” the visiting professor at Chuncheon’s Hallym University added.

Live footage of the breaches showed computer screens at the media companies completely down, while bank customers were unable to make withdrawals, or transfer money online.

“Dark Seoul” happened shortly after the North Korean government announced it would end the armistice agreement that brought the three-year Korean War to an end in July 1953 amid growing tensions with its neighbor.

Armistice announcement

The latest high-profile digital incursion, in December, attempted to steal data from South Korea’s nuclear operator, including plant blueprints and personnel information. Though investigators said no critical data was stolen, the attack raised serious concerns about the safety and security of the 23 nuclear power plants it runs.

The attack itself was described by James as a “spear-fishing” exercise where unsuspecting victims – retired and current employees of the nuclear operator – were prompted to open up a disguised document in their email.

“As soon as you double click on it, it starts running in the background of your computer where you can’t see … it’s also trying to open up your computer – what we call a back door – to give access to the infected system by the attacker,” he told CNN.

The attack, which James said was simpler than “Dark Seoul,” came just a few days after Sony Pictures said their systems has been “hacked,” another attack the South Korean authorities blamed on North Korea.

READ: North Korea denies Sony hack

Proving who did it

“From a law enforcement or investigation side, we’re trying to actually trace back to who did it,” said James.

Seoul announced in mid-March that some of the IP addresses used in December incursion could be traced back to Shenyang, China, which can be easily accessed from the North Korean border. Codes used in the attack were said to be similar in pattern to those used by the North Koreans, South Korean authorities said.

“The malicious codes used in the attack were same in composition and working methods as “Kimsuky” codes known to be used by North Korea,” the prosecutor’s office that leads 17 other government agencies and Internet companies in the investigation said in the statement in March.

Pyongyang has dismissed the claims it launched these attacks, calling them a “plot and fabrication that can never win over the truth.”

But many experts say North Korea appears to be investing more in cyberwarfare because it is cheaper than spending on conventional weapons and can cause significant economic damage to its southern rival. Indeed South Korea’s Defense Ministry estimates that North Korea is operating a “cyberarmy” of 6,000 workers as it focuses on strengthening its asymmetrical warfare capability.

“Hacks are going on all the time, constantly – though how many actually make the news is a very small amount,” said James.

“How many are detected in general? I think the average person would have no clue they’ve been hacked.

“Organizations need to invest the same amount that hackers are investing to protect themselves and right now they’re not,” he added.

Many in South Korea believe not enough effort is being put into defending against cyberattacks. A report by the Korea Institute for Industrial Economics and Trade, a government-funded think tank, estimates that “Dark Seoul” caused about $820 million worth of damage.

Its report, published in 2014, predicted that by 2020, South Korea could be exposed to hacking attacks causing up to $25 billion in economic damage.

READ: NSA will lead fight against future hacks