7.7 DDoS

lazarus.day

In July 2009, South Korea and the United States were targeted by a series of Distributed Denial of Service (DDoS) attacks, widely attributed to North Korean actors. These attacks involved overwhelming various websites and online services with excessive traffic, causing them to crash or become inaccessible. The targets included government, financial, and news websites in both countries. The coordinated cyberattacks highlighted the growing threat of state-sponsored cyber warfare and underscored the vulnerability of critical infrastructure to such disruptions.

CSIS Significant Cyber Incidents

Cyberattacks against websites in the United States and South Korea, including a number of government websites, were launched by unknown hackers. South Korea accused North Korea of being behind the attacks The denial of service attacks did not severely disr upt services but lasted for a number of days and generated a great deal of media attention.

EuRepoC

Presumably North Korea or pro-North Korean group(s) temporarily jams South Korean and US government and commercial websites.

EuRepoC

Operation Troy is one of the earliest known cyber espionage campaigns by the Lazarus Group, which took place between 2009 and 2012. It was primarily directed against the South Korean government in Seoul, but also against American targets and mostly utilised DDoS attacks, which were already considered unsophisticated but effective at the time. The first major incident in this operation, often referred to as the first wave, occurred on 4 July 2009 (on the Independence Day in the United States) and affected both the US and South Korea, hitting sites such as government entities like the White House and the Pentagon, but also the New York Stock Exchange, the Washington Post, NASDAQ and Amazon. On 7 and 9 July (unofficially the second and third waves), mainly targeted South Korean entities such as the Ministry of Defence, National Intelligence Service, National Assembly and South Korean banks, but also the US State Department. The attacks were carried out using the malware programmes Mydoom and Dozer, which attacked numerous websites and marked the "Independence Day reminder" in the master boot record (MBR) of the affected systems.

ThaiCERT Threat Group Cards

Operation “Troy” North Korean hackers are suspected of launching a cyber-attack on some of the most important government offices in the US and South Korea in recent days, including the White House, the Pentagon, the New York Stock Exchange and the presidential Blue House in Seoul. The attack took out some of South Korea’s most important websites, including those of the Blue House, the defense ministry, the national assembly, Shinhan bank, Korea Exchange bank and the top internet portal Naver. Target: Government, financial and media institutions in South Korea and USA. Method: DdoS attacks. https://www.theguardian.com/world/2009/jul/08/south-korea-cyber-attack

Dyadic Cyber Incident Dataset v2

Show of cyber capabilities to commemorate the 15th anniversary of the death of Kim Il Sung, and coincide with the launch of 7 new short range missiles.

Dyadic Cyber Incident Dataset v2

DDoS disruptive events on South Korean banks.

Dyadic Cyber Incident Dataset v2

Signaling campaign coinciding with the Fourth of July strike against the US

Dyadic Cyber Incident Dataset v2

DDoS disruptive events on governmental and private websites.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2009-07; Victims: 7.7 DDoS; Motivations: Destruction; Sectors: Finance Government; Countries: United States, Korea, Republic of

Wikipedia (English), accessed 2026-10-06

The Lazarus Group's first major hacking incident took place on July 4, 2009, and sparked the beginning of "Operation Troy". This attack utilized the Mydoom and Dozer malware to launch a large-scale, but quite unsophisticated, DDoS attack against US and South Korean websites. The volley of attacks struck about three dozen websites and placed the text "Memory of the Independence Day" in the master boot record (MBR).

CSIS, "North Korea's Cyber Operations: Strategy and Responses" (Dec 2015), Appendix

DDoS on 17 U.S. and ROK public and government websites

Seoul Shinmun (Yonhap) chronology: 북한의 국내 사이버 테러 일지 (2013-04-10)

▲2009.7.7 = 청와대와 국회, 네이버, 미국 재무부, 미국 국토안전부 등 한국과 미국의 주요기관 23개 사이트가 분산서비스거부(디도스·DDos) 공격으로 전산망 마비.

Seoul Shinmun (Yonhap) chronology: 북한발 역대 주요 사이버테러 일지 (2016-06-13)

▲ 2009.7.7 = 분산서비스거부(DDoS·디도스) 공격으로 청와대, 백악관 등 35개 주요 정부 기관·금융사·포털사이트 홈페이지 마비.

New America, "North Korea as a Geopolitical and Cyber Actor" (Leekyung Ko, 2018-06-06)

Reported to target the U.S. Independence Day celebration. A series of DDoS attacks on governmental, financial, and media websites seemed to bolster propaganda and demonstrate North Korea’s offensive cyber capabilities.

전자신문 (etnews) [이슈분석] 7·7 디도스, 6·25 사이버테러, 한수원 해킹심리전...홀수 해 반복되는 사이버도발 (2017-02-21)

2009년에 발생한 `7·7 디도스 공격`은 북한 소행으로 밝혀진 첫 대규모 사이버 테러다. 청와대를 비롯한 국방부·외교부·국가정보원 등 주요 정부기관부터 금융사, 언론사, 정당, 보안업체 등 국내 22개 기관·기업의 홈페이지가 공격을 받아 접속 장애가 발생했다. 미국의 백악관, 재무부, 연방무역위원회 등 해외 기관 14곳도 공격을 받았다. 피해 규모는 500억원 이상으로 추산됐다. ... 분석 결과 북한 체신성 IP 대역 PC에서 세계 61개국 435개 서버를 공격 자원으로 활용한 것으로 밝혀졌다.

한국일보 2009년 '7·7 디도스' 등 대부분 북한소행 결론 (2013-03-20)

2009년 7월 7~9일 국내 주요 사이트를 마비시킨 '7ㆍ7 디도스(DDoS·분산서비스거부) 대란'은 대표적인 사이버 공격 사건이다. 경찰은 당시 좀비PC에 공격명령을 내리도록 해킹당한 외국 서버를 통해 해커를 역추적, 공격 근원지가 북한 체신성이 중국에서 할당받은 IP(인터넷 주소)임을 밝혀냈다. 51개국 435대 서버가 공격에 활용됐고 27만대의 좀비PC가 동원된 것으로 조사됐다.

ZDNet Korea (zdnet.co.kr)

attribution sentence(s): 중국에 이어 다음으로 부각된 곳은 북한이다. | 공격목표가 미국과 한국이라는 점, 북의 첩보요원이 임무를 끝내고 자결하듯이 바이러스가 자폭하는 점, 또한 언론에서 발표한 110호 연구소와 관련된 부분 등을 들어 북한이라고 지목하고 있지만, 그것도 추측일 뿐 정확한 근거는 현재 나오지 않았다 | (북한의 ISP 기반을 설명하며 배후가 북한이라는 것은 근거 없는 낭설이라는 주장도 제기되고 있다).

2009년 7월 7∼9일 61개국에서 435대의 서버를 이용해 한국과 미국 주요기관 35곳의 사이트를 해킹한 '7·7 디도스 공격'의 공격 근원지는 중국에 있는 북한 체신성으로 확인됐다.

옥션의 경우는 언론에 보도된 내용에 의하면 이번 DDoS 공격으로 입은 피해액이 70억원에 이른다고 한다