Large-scale access from a North Korea internet protocol (IP) range was identified during hacking attempts targeting the financial sector. Financial authorities asked financial companies to review related access history and strengthen security monitoring.

On Oct. 28, the financial sector said financial authorities on Oct. 21 used the financial security integrated monitoring system FIRST to share "precautions regarding scan-like access by North Korea IPs targeting the financial sector" with financial companies, including digital asset exchanges.

Authorities said scan-like access targeting the financial sector was continuously detected from multiple North Korea IPs starting at 3 a.m. on Oct. 21.

Scan-like access refers to attempts to connect in order to check for vulnerabilities in a specific system or network ports open to the outside. It can be used to find security weaknesses ahead of an actual system intrusion.

The IP range authorities identified was 175.45.176.0/22, and much of the range is allocated to North Korea. The number of detected access attempts had reached about 4,404,101 by the time the official notice was sent.

Financial authorities asked each financial company to check its information security and internal control systems and strengthen real-time monitoring to detect abnormal signs. They also urged companies to inform authorities if any irregularities are found after checking access history linked to the IPs.

So far, there have been no confirmed cases in which access from the IP range led to an actual security breach and resulted in reported damage. It is also difficult to conclude the attacker was a North Korean hacker based solely on the use of a North Korea IP range.

A financial authorities official said, "Because it is possible to manipulate the nationality of an IP, it is difficult to identify a hacker's nationality based on an IP alone."

The Financial Supervisory Service previously also said some IPs are difficult to tie to a specific country and that interpretations require caution because access may be routed through other paths.