South Korean Police Seek FBI Help to Trace Hackers Behind Financial Cyberattacks

South Korean police are working with the US Federal Bureau of Investigation to identify hackers suspected of carrying out recent cyberattacks against financial institutions in Korea, according to people familiar with the matter.

The Korean National Police Agency and other domestic authorities have begun a cooperation process with the FBI, the people said Tuesday. Investigators are seeking information held by major cybersecurity and artificial intelligence companies based in the United States, including account details and access logs that may help establish who operated the accounts and infrastructure involved.

The cross-border request highlights the international nature of the investigation. Digital evidence relevant to an attack in Korea may be held by technology providers under US jurisdiction, making assistance from American authorities important to obtaining and authenticating records. The report did not specify which Korean financial institutions were targeted, when the attacks occurred or the extent of any disruption or damage.

Investigators are also reviewing an assessment by US cybersecurity company CrowdStrike, which suggested that a 26-year-old man from Guangdong Province in China might have been behind the attacks. The man has denied involvement. Korean authorities have not adopted that assessment as a final conclusion and are examining whether other people, or a different set of suspects, could be responsible.

Police are analyzing the data CrowdStrike used to estimate the hackers’ identities. They are also examining documents that reportedly indicate links to a Chinese group associated with distributed denial-of-service attacks. A DDoS attack attempts to overwhelm an online service with large volumes of traffic, potentially making it inaccessible to legitimate users.

The investigation therefore remains open, with both the attribution and the number of possible perpetrators unresolved. No arrest, charge or formal identification of a suspect was announced.

A police official declined to confirm details about the reported FBI cooperation, saying the agency could not verify specific progress, including whether cooperation was taking place. The response leaves the operational status of the request undisclosed while authorities continue to examine technical records and competing theories about responsibility.

The case adds to concerns about the exposure of Korea’s financial sector to attacks that can involve overseas actors, infrastructure and service providers. For investigators, obtaining access records and matching them with technical indicators gathered in Korea will be central to testing the existing attribution and determining whether the attacks were conducted by an individual or a wider group.