Cisco Blogs


Cisco Blog > Security

Thoughts on DarkSeoul: Data Sharing and Targeted Attackers

The attacks against South Korean media and banking organizations last week severely disrupted a handful of organizations with a coordinated distribution of “wiper” malware designed to destroy data on hard drives and render them unbootable. At 14:00 KST on March 20, 2013, the wiper was triggered across three media organizations and four banks, setting off a firestorm of speculation and finger-pointing and that which continues as of this writing. In this post, I’ll share a perspective no one else seems to be talking about, but may be the real motivation behind these attacks.

The What and the Possible Why

Let’s start with what we know:

  • The attack was highly targeted
  • The malware was specifically designed to distribute the wiper payload throughout the impacted organizations
  • The malware was timed to deploy its destructive payload simultaneously across all affected organizations
  • The resulting loss of data and downtime has been severe

While the “what” of the attack is well established, the “why” and “how” are still a matter of debate. Theories postulated include an outright act of warfare from North Korea designed to economically disrupt South Korea, or an act of sabotage to cover the tracks of data exfiltration allegedly wrought by China. But what if there were an explanation that was less about countries and politics and more about that all-time motivator of crime: money? Consider, if you will, the following timeline. Read More »

Tags: , , , , , , ,