Police expand financial institution hacking probe team to 43, block attack server

[Financial News] Police are expanding the dedicated team investigating the recent hacking of financial institutions to 43 members and stepping up international cooperation, including efforts to block the attack server.
On the 9th, the Korean National Police Agency’s National Office of Investigation said that police formed a dedicated investigation team on the 5th in view of the seriousness of the financial institution hacking case, then added 15 support personnel on the 7th, including digital forensics and international-cooperation specialists. The team has consequently grown from 28 to a total of 43 members.
Police are analyzing related materials, including log records obtained from affected companies, while pursuing the investigation by tracing the attackers, including blocking the attack server through international cooperation. They have also established a framework for cooperation with relevant agencies, including the Financial Security Institute, and are analyzing the affected systems in parallel.
Police began a preliminary investigation before formally booking a suspect shortly after the first media report on the financial institution hacking emerged on the 1st. They have since obtained related materials and continued investigating the attack route and tracking the suspects.
Recently, global cybersecurity company CrowdStrike raised the possibility that the attacker was a 26-year-old person living in China’s Guangdong Province. Police are examining that information as an investigative lead.
Police say they will continue the investigation regardless of the possibility that the case may be transferred to the Serious Crime Investigation Agency. They have asked the Financial Services Commission for an authoritative interpretation of whether the compromised systems at the affected financial institutions qualify as electronic financial infrastructure.
The Korean National Police Agency explained that it has the authority to begin and conduct investigations into all cybercrimes, and that if a case is transferred because it constitutes a serious crime under the Serious Crimes Investigation Agency Act, the Serious Crimes Investigation Agency will take over the investigation from that point on.
A Korean National Police Agency official said, “Even if the case is transferred to the Serious Crimes Investigation Agency in the future, we will investigate thoroughly and track the suspects to ensure there is no gap in the investigation up to that point.”

[email protected] Kim Ye-ji Reporter