2009 DDoS attacks against South Korea

Among the websites affected were those of the White House, The Pentagon, the New York Stock Exchange, the Washington Post, the NASDAQ, and Amazon.

[14] A third wave of attacks began on July 9, 2009, targeting several websites in South Korea, including the country's National Intelligence Service as well as one of its largest banks and a major news agency.

[17] However, Jose Nazario, manager of a U.S. network security firm, claimed that the attack is estimated to have produced only 23 megabits of data per second, not enough to cause major disruptions.

"[6] It was expected that the economic costs associated with websites being down would be large, as the disruption had prevented people from carrying out transactions, purchasing items or conducting business.

[8] According to the South Korean National Intelligence Service, the source of the attacks was tracked down and the government activated an emergency cyber-terror response team who blocked access to five host sites containing the malicious code and 86 websites that downloaded the code, located in 16 countries, including the United States, Guatemala, Japan and the People's Republic of China, but North Korea was not among them.

The attack started on July 4, 2009, the same day as a North Korean short-range ballistic missile launch, and also occurred less than one month after the passage of UN Security Council Resolution 1874, which imposed further economic and commercial sanctions on North Korea in response to an underground nuclear test conducted earlier that year.

South Korean police analyzed a sample of the thousands of computers used by the botnet, stating that there is "various evidence" of the involvement of North Korea or "pro-North elements," but said they may not find the culprit.

"[21] Joe Stewart, researcher at SecureWorks' Counter Threat Unit, noted that the data generated by the attacking program appeared to be based on a Korean-language browser.