On March 20, 2013, at 2:00 PM Korean time, the networks of three South Korean banks and three media companies went dark simultaneously. Screens displayed a skull, systems stopped responding, and administrators found that workstations across their organizations had had their master boot records overwritten with a wiper that had been silently staged inside their networks for weeks. An estimated 32,000 computers were destroyed. ATMs and banking systems went offline. South Korea's financial and media infrastructure was partially paralyzed.

The attack, known as Operation Dark Seoul or the "3.20 Cyber Attack" in South Korea, was blamed on North Korea, a link Seoul later asserted and Pyongyang denied. Some analysts have tied it to the group later labelled Lazarus, but the sources reviewed here do not document that link. For South Korea, it was not a surprise - a prior campaign in 2009 (Operation Trojan Horse) had attacked government websites with DDoS. But Dark Seoul's use of destructive wipers rather than website defacement or DDoS marked a qualitative escalation in the threat.

The Wiper Campaign

Dark Seoul's wiper malware (analyzed under various names including MBR Killer, DarkSeoul, and WhiskeyAlfa/Charlie) was deployed through a supply chain compromise. The attackers had compromised the patch distribution system of a South Korean security software vendor - specifically, an enterprise security management tool that many South Korean organizations used to distribute software patches to networked computers. By inserting their wiper malware into the software distribution system, they could deploy it silently to every endpoint registered with that system across multiple unrelated organizations simultaneously.

The supply chain approach explained the simultaneous nature of the attack: at a scheduled time, the wiper activated on all infected machines at once, overwriting MBRs and making systems unbootable. The simultaneously timing was deliberate - it prevented IT staff at one organization from warning others and created maximum disruption across all targets before remediation could begin.

[TECHNICAL NOTE]
Dark Seoul's use of a security software patch distribution system as the delivery mechanism was notable on several levels. First, it illustrated the "trusted software" supply chain attack vector that SolarWinds and the XZ Utils backdoor would later demonstrate to Western audiences - using a legitimately trusted update channel to deliver malware at scale, bypassing endpoint security that was configured to trust updates from that channel. Second, the Korean security software vendor's patch system had access to every endpoint it managed - by definition, enterprise patch distribution tools need elevated privileges to install software. Compromising the patch system gave the attackers pre-elevated, pre-deployed access to every managed endpoint simultaneously. Third, the security software itself was an ironic target: the system trusted to protect Korean organizations became the vector for their simultaneous compromise. The technical lesson - that software distribution channels require the same security scrutiny as the endpoints they manage, and that trusting signed software from known vendors is insufficient if the signing keys or distribution infrastructure can be compromised - was not widely implemented in Western enterprise environments until the SolarWinds breach in 2020.

Attribution

South Korea's Korea Internet and Security Agency (KISA) and intelligence services attributed Dark Seoul to North Korea within days of the attack. The evidence was analyzed over subsequent months and included: malware code similarities to prior North Korean operations; Chinese IP addresses used in the attack that were also associated with prior North Korean cyber operations (North Korea uses Chinese infrastructure as C2 proxies); Korean-language strings in the malware code written with North Korean vocabulary differences from South Korean Korean; and operational patterns consistent with North Korean working hours and targeting priorities.

In July 2013 South Korea's science and ICT ministry said the March and June 2013 incidents matched past North Korean hacking methods, and that an IP address used in the attacks matched one used in earlier attempts attributed to Pyongyang. North Korea denied involvement.

[WARNING]
Operation Dark Seoul demonstrated a characteristic of nation-state cyber operations that analysts had theorized but not previously seen so clearly in a publicly attributed attack: the use of cyberweapons as instruments of political coercion and messaging rather than as tools of espionage or financial crime. The timing of the March 20 attack coincided with a period of heightened tension on the Korean peninsula; North Korea had conducted a nuclear test in February 2013 and had been under intensified UN sanctions. The attack was designed to demonstrate that North Korea could impose costs on South Korea's civilian infrastructure at will - a deterrence message sent through destructive cyber operations. This "coercive cyber operation" concept - using destructive attacks to communicate capability and willingness rather than to achieve specific intelligence or financial objectives - has become a recognized category of state cyber behavior, observed subsequently in Russian operations against Ukraine (BlackEnergy, NotPetya) and Iranian operations against Gulf states (Shamoon). Dark Seoul was among the earliest clear examples of this strategic use of cyberweapons.

South Korea's Cyber Resilience Response

South Korea had already been developing significant cyber defense capabilities following the 2009 DDoS attacks - the attacks had led to the establishment of KISA's cyber emergency response center and increased investment in national cyber defense. Dark Seoul accelerated this investment. South Korea increased funding for civilian critical infrastructure protection, and developed more sophisticated threat intelligence sharing between private sector organizations and government agencies.

The simultaneous targeting of both financial institutions and media organizations was significant for the response: media companies might not have expected to be alongside banks as priority targets of a sophisticated state adversary. The inclusion of media targets reflected North Korean doctrine of information operations alongside destructive cyber attacks - shutting down media organizations while attacking financial infrastructure prevented public reporting during the crisis period and contributed to confusion and panic.

[IOC]
Operation Dark Seoul (3.20 Cyber Attack) summary: execution March 20, 2013, 2:00 PM KST. Targets: Shinhan Bank, Nonghyup Bank (NACF), Jeju Bank, MBC, KBS and YTN. Machines destroyed: estimated 32,000 workstations (MBR overwrite via wiper). Delivery mechanism: compromise of South Korean security software patch distribution system for simultaneous deployment. Wiper names: MBR Killer, DarkSeoul, WhiskeyAlfa/WhiskeyCharlie/WhiskeyBravo (different analysis vendor names). Predecessor campaign: Operation Trojan Horse (2009) - DDoS attacks against South Korean government and US government websites. Attribution: suspected North Korea; Seoul asserted the link and Pyongyang denied it. Timeline context: followed North Korea's February 2013 nuclear test and UN sanctions escalation; preceded Sony Pictures (2014), Bangladesh Bank heist (2016), WannaCry (2017), Ronin bridge (2022). Strategic significance: first clearly documented case of simultaneous multi-sector wiper attack on a nation-state's civilian infrastructure; established coercive destructive cyber operation doctrine. South Korean response: accelerated establishment of Cyber Command; increased public-private threat intelligence sharing; enhanced critical infrastructure protection investment.