South Korea

This page covers cyber threats to South Korea. It brings together official texts (the National Intelligence Service, the Korea Internet and Security Agency KISA, the Personal Information Protection Commission, the Korean statute translations, US and UK government advisories and statements, and MITRE ATT&CK) and Brandefense research. Where an official source names South Korea as a target, the page says who said it and when.

Threat groups that official sources link to South Korea

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT38: the US advisory AA20-239A (CISA, Treasury, FBI and US Cyber Command, 26 August 2020) says a North Korean government group it calls the BeagleBoyz likely targeted financial institutions in a list of nations from 2015 through 2020. South Korea is on the list. The advisory says the group overlaps with groups known as APT38 and Lazarus Group.

Lazarus Group: MITRE ATT&CK says the group Andariel has focused its operations on South Korean government agencies, military organizations and a variety of domestic companies, and that Andariel is considered a sub-set of Lazarus Group. The same advisory AA20-239A lists Lazarus Group among the names that overlap with the BeagleBoyz.

Sandworm: on 19 October 2020 the UK government said the Russian military intelligence (GRU) unit known in open sources as Sandworm targeted multiple entities across South Korea that were linked with the 2018 Winter Olympics in Pyeongchang. It said the unit tried to disguise itself as North Korean and Chinese hackers and targeted broadcasters, a ski resort, Olympic officials and sponsors.

Two more North Korea-linked groups are covered in the library. MITRE ATT&CK says APT37 has targeted victims primarily in South Korea. The US advisory AA20-301A says Kimsuky collects intelligence against individuals and organizations in South Korea, Japan and the United States, and specifically targets think tanks and South Korean government entities.

Incidents on record

The incidents listed below are the major ones with national impact that official bodies or the organizations themselves reported. Where sources differ, the incident page says so. Small incidents are not listed.

How attackers target South Korea: Brandefense research

State-linked. Our Konni profile describes a North Korea-linked group focused on long-term intelligence collection against South Korean, Japanese, Russian and wider diplomatic targets, mostly through spearphishing and the KONNI remote access tool. The RokRAT research summary says APT37 has targeted South Korea, Japan and neighboring regions with phishing emails that carry .lnk files disguised as PDFs, and our APT37 post says the group grew from mainly targeting South Koreans into global operations. The Lazarus Group post lists the 2013 DarkSeoul operation, in which South Korean banks and broadcasters found their systems wiped.

The Silent Chollima post says the group breached defense and technology contractors in the United States and South Korea using spear-phishing and known VPN flaws, and the APT38 post lists South Korea among the countries where it has operated. Other groups appear too. The Sandworm post describes Olympic Destroyer at the 2018 Winter Olympics in PyeongChang, the Tick profile puts its focus on Japan, South Korea and Taiwan, and the Liminal Panda post describes 2023 phishing against defense research organizations in Singapore and South Korea. The APT33 post says the Iran-based group has targeted aviation and energy in the United States, Saudi Arabia and South Korea. The DarkHotel profile says the group is believed to be associated with South Korea.

Fraud and mobile. Our fake mobile app post describes a campaign tied to at least 280 APKs spread outside Google Play through SMS messages and malicious social media posts. The apps pretended to be South Korean and UK government services, dating sites and similar services, and the campaign mainly targeted South Korea.

Ransomware. Our most affected products post says threat actors are known to target vulnerable systems in South Korea with the Magniber ransomware campaign, and lists it alongside CVE-2021-34527.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team in South Korea learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Act on Promotion of Information and Communications Network Utilization and Information Protection (the Network Act) aims to facilitate the use of networks, protect people using information and communications services and build a safer environment for network use. The Act on the Protection of Information and Communications Infrastructure aims to operate critical infrastructure stably in preparation for electronic intrusion. It defines this infrastructure to include systems related to national security, finance, communications, transportation and energy, and defines electronic intrusion as attacks by hacking, computer viruses, logic or email bombs, denial of service or high power electromagnetic waves.

How incident response is organized

The National Intelligence Service (NIS) oversees national cyber security policy by formulating and coordinating its execution. It monitors major national networks, issues warnings with a risk level when it sees a concrete threat to government or public IT networks, and investigates intrusions against government and public organizations. KISA monitors traffic abnormalities, major internet failures and intrusions 24 hours a day, 365 days a year, and runs the Boho KrCERT/CC website, which explains threats such as hacking, smishing and ransomware to the public. The 2024 National Cybersecurity White Paper was published jointly by the NIS, the Ministry of Science and ICT, the Ministry of the Interior and Safety, the Personal Information Protection Commission, the Financial Services Commission and the Ministry of Foreign Affairs, with contributions from KISA.

Personal data

The Personal Information Protection Act aims to protect the freedom and rights of individuals by regulating how personal information is processed and protected. Under Article 34, a controller must notify data subjects without delay when it learns of loss, theft or divulgence of personal information. The Personal Information Protection Commission (PIPC) handles laws, policies, investigations of rights violations and complaints. On 27 August 2025 it resolved to sanction SK Telecom under the Act with a penalty of KRW 134.79 billion, after a joint task force with KISA found data breaches that include personal information of approximately 23 million subscribers.

The official sources opened for this page name no attack counts for South Korea. Figures will come from Brandefense Atlas.