A Chinese internet address was the source of a cyberattack on one company hit in a massive South Korean network shutdown that affected 32,000 computers at six banks and media companies, initial findings have indicated.
It is too early to assign blame - internet addresses can easily be manipulated and the investigation could take weeks. But suspicion for Wednesday's shutdown quickly fell on North Korea, which has threatened Seoul and Washington with attack in recent days because of anger over UN sanctions imposed for its February 12 nuclear test.
South Korean regulators said they believe the attacks came from a "single organisation", but they have still not finished investigating what happened at the other companies.
Experts say hackers often attack via computers in other countries to hide their identities.
South Korea has previously accused North Korean hackers of using Chinese addresses to infect their networks. Seoul believes North Korea runs an internet warfare unit aimed at hacking US and South Korean government and military networks to gather information and disrupt service.
The attack caused computer networks at major banks and TV broadcasters to crash simultaneously. It paralysed bank machines across the country and raised fears that the heavily internet-dependent society was vulnerable.
A Chinese address created the malicious code in the server of Nonghyup bank, according to an initial analysis by the state-run Korea Communications Commission, South Korea's telecom regulator.
Investigators are analysing the log-in records and the malicious code collected from the infected servers and computers. It could take at least four to five days for the infected computers to recover fully, and experts say the investigation could take weeks.
South Korean regulators have also distributed vaccine software to government offices, banks, hospitals and other institutions to prevent more outages.
In an indication of the high tension on the Korean Peninsula, South Korean media reported that North Korea sounded air-raid warnings in radio broadcasts as part of military drills.