South Korea suspects North Korea-backed groups involved in dozens of cyberattacks in past year: Report

By Anadolu staff

ANKARA (AA) - Several North Korean hacking groups are suspected to be behind dozens of cyberattacks in the past year, a Seoul-based software security firm said Sunday.

AhnLab Inc. said in its latest assessment report that North Korean hacking group Lazarus topped the list of advanced persistent threat (APT) groups with 31 incidents from October 2024 to September 2025, amid suspicion that the network was involved in a recent massive cryptocurrency breach at South Korean crypto exchange Upbit, Seoul-based Yonhap News reported.

Another group, Kimsuky, followed with 27 cases, data showed.

In addition to North Korea, which accounted for 86 hacking incidents, Chinese, Russian, Indian and Pakistani groups were also allegedly involved in scores of cyberattacks during the same period.

The report comes amid mounting speculation that Lazarus was responsible for a breach that drained 45 billion won ($30.6 million) worth of cryptocurrency from Upbit last week.​​​​​​​

The techniques used in the heist were similar to those employed in a 2019 attack in which the group allegedly stole 58 billion won worth of Ethereum from Upbit, said authorities.

*Writing by Aamir Latif