Article
The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella
Lazarus Group profile: active since at least 2009, with aliases and major incidents such as Sony Pictures, WannaCry and Bybit, plus defense guidance.
Read more
Significant cyber incident
South Korea 3.20 cyberattack on broadcasters and banks, 2013
On 20 March 2013 at about 2 p.m., the networks of three South Korean broadcasters (KBS, MBC and YTN) and several banks stopped working at the same time.
In short
On 20 March 2013 at about 2 p.m., the networks of three South Korean broadcasters (KBS, MBC and YTN) and several banks stopped working at the same time. Malware wiped hard drives, and damaged machines are counted at 30,000 to 48,700 depending on the source. On 10 April 2013 the Korea Internet and Security Agency (KISA) said North Korea's Reconnaissance General Bureau led the attack, prepared for at least eight months.
What happened
On 20 March 2013, around 2 p.m., the computer networks of the broadcasters KBS, MBC and YTN and of several banks stopped working at the same time. Police and KISA said screens went blank, some showed skulls, and some files were deleted. Cash machines across the country were disabled.
Programming at the broadcasters was not affected, and AP and Reuters reported that the government, the military and infrastructure such as power stations, ports and airports were not affected. Recovery took days. Sources differ on how fast: AP said only Shinhan Bank was fully back on 21 March, while PBS says the three banks were online two days after the attack and the TV networks took longer.
The cause was at first unclear. On 21 March the Korea Communications Commission (KCC) said the malicious code traced to a Chinese IP address. By the next day it corrected this: the address belonged to a computer on the internal network of Nonghyup Bank. On 10 April 2013, KISA said an official investigation pointed to the Reconnaissance General Bureau of North Korea, and AFP reported the same finding.
North Korea had accused South Korea and the United States of hacking its own websites in the days before. Tension was high after its February nuclear test and during joint military drills.
Timeline
-
2009 to 2012
AP reports that the National Intelligence Service believes North Korea was behind six cyberattacks on South Korea.
-
12 February 2013
North Korea carries out a nuclear test; UN sanctions follow and tension rises.
-
Mid-March 2013
North Korea accuses South Korea and the United States of an attack that took its websites offline.
-
20 March 2013, about 2 p.m.
Networks at KBS, MBC, YTN and several banks halt together; broadcasters and banks report to the National Police Agency.
-
20 March 2013
A Defence Ministry spokesman says North Korean involvement cannot be ruled out but it is premature to say so; the military raises its readiness level.
-
20 March 2013
Regulators begin distributing vaccine software to government offices, banks and hospitals.
-
21 March 2013
The KCC says the malicious code traced to an IP address in China; AP reports only Shinhan Bank is fully back online.
-
22 March 2013
The KCC corrects its statement: the address belonged to a computer on Nonghyup Bank's internal network (PBS, "by the next day").
-
About 22 March 2013
PBS reports the three affected banks are back online two days after the attack; TV networks take longer.
-
10 April 2013
KISA says the probe points to North Korea's Reconnaissance General Bureau and that the attack was prepared for at least eight months.
How the attack worked
Preparation
KISA said on 10 April 2013 that the attack had been planned up to eight months earlier and had similarities to past North Korean hacking attempts. AFP reported that investigators traced the origin to six computers in North Korea and that the attackers went through 49 places in 10 countries, including South Korea, to reach their targets. The North had used 22 of those places in past attacks.
Spread and the wipe
The regulator’s first analysis said a malicious code spread through a Nonghyup server. AFP, quoting KISA, says the malware could wipe the contents of a computer’s hard disk and connected drives. Guardian News reported that hard drives of PCs at YTN, MBC and KBS were wiped. The public sources opened do not describe the first entry point, so none is stated here.
Why the first finding was wrong
The KCC first pointed to a Chinese IP address, then said it was an internal address at Nonghyup Bank that matched a public address in China. AP noted that IP addresses can easily be manipulated and disguised.
- PrepareKISA says the attack was planned up to eight months earlier
- RouteSix computers in North Korea reached South Korean servers through 49 places in 10 countries (KISA, via AFP)
- SpreadMalicious code spread through a Nonghyup server (KCC first analysis, via AP)
- WipeMalware wiped hard disks; networks halted at about 2 p.m. on 20 March
Who says who was behind it
Attributed by KISA, 10 April 2013: its probe of access records and malicious code pointed to North Korea's military Reconnaissance General Bureau as the source (AFP; AP and Guardian News gave the same finding). Sources opened: reports of KISA statements, not the agency's own page.
Before that, on 21 March 2013, South Korean investigators said they had no proof that North Korea was behind it (AP), and the Defence Ministry said North Korean involvement could not be ruled out (20 March).
Sources differ on the early origin: the KCC first said a Chinese IP address, then corrected it to an internal Nonghyup Bank address; PBS also reports a KCC official saying some IP addresses traced to overseas sources.
MITRE ATT&CK describes Lazarus Group as attributed to the Reconnaissance General Bureau and says its malware correlates to campaigns including DarkSeoul. MITRE also says specific North Korean operations are hard to attribute with high confidence. This page does not claim more than KISA and MITRE state.
Impact
Computers: AP counted about 32,000 disabled computers; Guardian News said more than 30,000 had hard drives wiped; PBS estimated 30,000; KISA, via AFP, counted about 48,700 damaged machines including PCs, ATMs and servers. Sources differ on the total.
Banks: scores of cash machines were disabled; by 21 March all ATMs were back except those at 16 Nonghyup branches (AP).
Broadcasters: office computers were frozen, but programming was not affected (AP, PBS).
Wider effect: the government, military and infrastructure were not affected (AP, Reuters as quoted). No immediate reports that customer bank records were compromised (AP).
A US-based human rights group's website was also hacked, with content deleted (AP).
Figures for financial loss are not given in the sources opened.
Government and regulator response
- 20 March 2013: The military raised its readiness level and the Defence Ministry said it could not rule out North Korea. Regulators began handing out vaccine software to government offices, banks and hospitals (AP).
- 21 to 22 March 2013: The KCC gave a first finding of a Chinese IP address, then corrected it. A KCC official said: “We were careless in our efforts to double-check and triple-check” (PBS).
- 10 April 2013: KISA presented the result of the joint investigation naming the Reconnaissance General Bureau (AFP).
- After the attack: The government was reported to be looking at creating a Cyber Security Secretary position (PBS).
Lessons
-
Plan for wipers, not only data theft
The malware wiped hard drives, so backups and quick rebuilds decided how long outages lasted.
-
Many targets can fail together
Six organizations in media and banking were hit at once. Shared dependencies and common tools deserve a joint review.
-
Be careful with early attribution
The first IP finding was corrected within a day. Wait for evidence before naming a source in public.
-
Core services can survive a desktop wipe
Broadcasters kept programming running while office PCs were frozen. Separate production systems from office networks.
-
Preparation can start months before
KISA said the attack was prepared for up to eight months. Long-running access is worth hunting for.
What to check in your own organization
-
Backups
Test that you can rebuild workstations and servers quickly from clean images, and keep copies offline.
-
Central update tools
List the tools that can push software to many machines at once and limit and log who can use them.
-
Wiper detection
Alert on mass file deletion and disk overwrite activity, and test the alert.
-
Segmentation
Check that office networks cannot reach production and ATM or branch systems freely.
-
Incident communication
Agree who may state a cause in public and require evidence before doing so.
-
Partner exposure
Ask which shared providers or tools could take down several of your sites at once.
Where it happened
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
- Country South Korea South Korea faces cyber espionage and destructive attacks linked by official sources to North Korean state groups, and large data breaches at telecom and retail firms. Asia Pacific
Questions
What was the 3.20 attack?
A coordinated attack on 20 March 2013 that halted networks at KBS, MBC, YTN and several banks in South Korea, with hard drives wiped.
Who did South Korea say was behind it?
On 10 April 2013 KISA said its probe pointed to North Korea's Reconnaissance General Bureau. Sources opened report this finding second-hand, not from the agency's page.
How many computers were hit?
Sources differ: about 30,000 (PBS), about 32,000 (AP) and about 48,700 (KISA via AFP).
Did it come from China?
The KCC first said a Chinese IP address, then corrected it to an internal Nonghyup Bank address.
Was television broadcasting stopped?
AP and PBS report that broadcasters said programming was not affected, although office computers were frozen.
Is DarkSeoul the same thing?
MITRE ATT&CK lists DarkSeoul among campaigns whose malware correlates to Lazarus Group. The sources opened do not themselves call the 3.20 attack DarkSeoul, so treat the name as an alias used by others.
In our research
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
- Lazarus APT Group (APT38) August 2022
- Andariel Threat group
Sources
- Probe shows Chinese address as source of cyberattack in South Korea (AP copy) Associated Press via Fox News
- South Korea: Cyberattack traced to Chinese address (AP copy) Associated Press via The Christian Science Monitor
- South Korea cyberattack: whodunit? The Christian Science Monitor
- South Korea says North Korea behind computer crash in March (AP copy) Associated Press via Inquirer
- Seoul: North Korea behind March hacking Guardian News via Mail and Guardian
- Probe says North Korea behind cyber attack: Seoul Agence France-Presse via DefenceTalk
- South Korea Hit Hard by Massive Cyber-Attack PBS NewsHour Extra
- South Korea Eyes Pyongyang After Possible Cyberattack NPR
- Lazarus Group (G0032) MITRE ATT&CK
- Disk Wipe, Technique T1561 - Enterprise MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.