Maritime cybersecurity in South Korea - Disclosed incidents

Most impacted maritime activities - South Korea

• Shipyard: 6 maritime cybersecurity incidents publicly disclosed (50.0%)
• Defence: 2 maritime cybersecurity incidents publicly disclosed (16.7%)
• Ship: 2 maritime cybersecurity incidents publicly disclosed (16.7%)
• Offshore: 1 maritime cybersecurity incident publicly disclosed (8.3%)
• Shipowner: 1 maritime cybersecurity incident publicly disclosed (8.3%)

Incident types - South Korea

• Virus/Ransomware: 5 maritime cybersecurity incidents publicly disclosed (41.7%)
• GPS/AIS jamming/spoofing: 4 maritime cybersecurity incidents publicly disclosed (33.3%)
• Intrusion: 2 maritime cybersecurity incidents publicly disclosed (16.7%)
• Spearphishing: 1 maritime cybersecurity incident publicly disclosed (8.3%)

Maritime cybersecurity incidents publicly disclosed - South Korea

Date	Type	Victim	Incident summary
21/02/2022	Virus/Ransomware	Shipyard	A shipyard is hit by a cyberattack.
21/06/2021	Virus/Ransomware	Shipyard	A naval shipyard is hit by a cyberattack. Data leak.
15/06/2021	Intrusion	Shipyard	The messaging system of a naval industry group is hit by an attack.
24/10/2021	Virus/Ransomware	Shipyard	A shipyard is hit by a cyberattack.
01/01/2017	Spearphishing	Shipowner	Multiple Business Email Compromises (BEC) targeting South Korea and Japan.
01/04/2016	Intrusion	Shipyard	Shipyard hit by a cyberattack. Data leak.
01/04/2016	GPS/AIS jamming/spoofing	Ship	280 ships hit by GPS issue sail back to port.
01/09/2013	Virus/Ransomware	Shipyard	Campaign targeting JP and KR maritime and ship-building groups.
28/04/2012	GPS/AIS jamming/spoofing	Defence	A wide area is covered with GPS jamming impacting numerous vessels.
04/03/2011	GPS/AIS jamming/spoofing	Ship	GPS jamming was detected over a wide area impacting 10 ships.
XX/XX/2010	Virus/Ransomware	Offshore	An offshore platform is infected by malware - 19 days of downtime on some systems.
23/08/2010	GPS/AIS jamming/spoofing	Defence	GPS jamming was detected over a wide area impacting 1 navy ship.

Claimed or reported threat actors having impacted South Korea

• North Korea: 4 maritime cybersecurity incidents publicly disclosed (33.3%)
• Icefog: 1 maritime cybersecurity incident publicly disclosed (8.3%)
• Gold Galleon: 1 maritime cybersecurity incident publicly disclosed (8.3%)
• Hive: 1 maritime cybersecurity incident publicly disclosed (8.3%)

Files generated on Monday, 11th December 2023.
ADMIRAL is licensed under the Creative Commons license. Copyright © France Cyber Maritime 2023.