China’s Retaliation against S. Korea over THAAD Spreads to Cyber Attacks

With China escalating economic retaliations on South Korea over the deployment of the U.S.-led Terminal High Altitude Area Defense (THAAD) missile defense system, there have also been a series of cyber attacks that were suspected of coming from China.

In particular, companies mainly related to the deployment of the THAAD system have recently hit by distributed denial of service (DDoS) attacks and defacement of their websites from suspected Chinese hackers.

This is why there are concerns that China’s economic retaliation against the nation over the THAAD issue can escalate into the cyber war.

The government has also urged both companies, which are related to the THAAD system or run business in China and domestic conglomerates, to take extra precautions to keep away from China-based cyber attacks, including the defacement.

According to security industry sources on March 6, the Chinese website for the entire Lotte Group was recently hacked and all the websites of Lotte Duty Free were down for about three hours due to DDoS attacks on March 2. The attacks came after the group approved a land swap to allow the THAAD system on what was once its property. Currently, the National Police Agency have begun an investigation to find out the origin of the latest DDoS attacks. Some say that they are China’s cyber retaliation against Lotte.

In addition to Lotte, two websites in South Korea were defaced by hackers on March 2. A hacking group named Panda Intelligence Bureau (PIB) changed the main screen of the websites black and poured out insults and harsh criticism against South Korea and Lotte which provided the site for the THAAD system. The phrases like “Boycott Lotte” and “Fight Back against THAAD” were posted on the website. Accordingly, industry experts assumed that the PIB was a Chinese hacking group.

As the cyber attacks were allegedly carried out by Chinese hackers, the Ministry of Science, ICT and Future Planning (MSIP) and the Korea Internet & Security Agency (KISA) started monitoring the websites of top 100 domestic companies, including Lotte, more thoroughly. The MSIP and the KISA keep checking the websites to monitor whether they are infected with malicious code and targeted by the defacement and DDoS attacks. A total of 160 to 170 workers will monitor them.