South Korea Seeks China's Cooperation in Probe into Cyberattack on Nuclear Operator

Seoul: South Korea is seeking the cooperation of Chinese authorities in a probe into a cyberattack on its nuclear power plant operator after tracing multiple Internet addresses involved to a northeastern Chinese city near North Korea, a prosecution official said on Wednesday.

The location of the Internet addresses, which were used to connect to networks in South Korea for the attacks, did not prove the source of the hack was either China or North Korea, said the official, who spoke on condition of anonymity.

"When we have the cooperation of the Chinese, where of course we don't have jurisdiction, we will be asking for checks or maybe a search of the location of the IP addresses," the official said.

"As we're doing this, there is a possibility that the IP addresses in China are not the final source but used in a routing. It's possible (the network) in China was used (remotely) from some other location."

Chinese Foreign Ministry spokeswoman Hua Chunying said: "I regret that I'm not aware of the specific situation but I can tell you, China's relevant position has been consistent. We resolutely oppose hacking activities in any form."

Korea Hydro and Nuclear Power Co Ltd (KHNP), which runs South Korea's 23 nuclear power reactors, said last week its computer systems had been hacked but only non-critical data had been stolen. Operations were not at risk, it said.

The official close to the investigation reiterated his team had not ruled out the involvement of North Korea in the attack but there was also no indication yet to believe it was involved. North Korea remains technically at war with the South.

Connections to South Korean virtual private networks (VPNs) used in the cyberattacks were traced to multiple IP addresses in China's Shenyang city, located in a province which borders North Korea, the official said.

The country's nuclear operator, watchdog and the ministry have set up emergency teams to remain on stand-by for two days starting from Wednesday as a self-claimed hacker demanded the shutdown of three reactors by Thursday in Twitter messages, threatening to create "destruction".

President Park Geun-hye has called the leaks "grave" and cyber security has been boosted at the country's nuclear plants.

The incident at the nuclear operator came after the United States accused North Korea of a serious cyberattack on Sony Pictures and vowed to respond proportionately.

There was no indication that the cyberattacks against the South Korea nuclear operator, part of state-run utility Korea Electric Power Corp was related to the attack on Sony, the prosecution official said.