Cyberattacks surge in South Korea amid generative AI adoption
South Korea reported a 19.5% surge in cyberattacks during the first half of 2026 compared to the same period the previous year, with DDoS and ransomware attacks surging particularly sharply. Government officials attributed the rise partly to increased attack sophistication driven by generative AI deployment.
What happened
In the first half of 2026, South Korea recorded 1,236 cyberattacks reported to the Korea Internet & Security Agency (KISA), a 19.5% increase from the previous year's first half (1,034 incidents) and 37.5% higher than 2024's first half (899 incidents).
According to the Ministry of Science and ICT and KISA, distributed denial-of-service (DDoS) attacks surged 56.7% from 238 to 373 cases, while ransomware reports rose 76.8% from 82 to 145 cases. Server hacking declined 8.3% from 531 to 487 cases. Overall, server hacking accounted for 39.4% of incidents, DDoS for 30.2%, and malware including ransomware for 16.3%.
Reported impact
Generative AI is being weaponized to accelerate attack preparation; attackers use AI to discover vulnerabilities, compare code before and after patches, draft attack code, organize reconnaissance results, and conduct repeated experiments more rapidly. AI agents connected to external systems such as email, code repositories, cloud services, and collaboration platforms can expand the attack surface significantly.
Ransomware employing double extortion tactics—exfiltrating critical data before encryption and demanding payment for both decryption and non-disclosure—is spreading. Credential stuffing attacks using credentials harvested from the dark web are ongoing, and API vulnerabilities continue to enable personal data breaches.
Index analysis
The ministry attributed heightened awareness of breach reporting to a major 2025 telecommunications incident affecting three carriers, partly explaining the surge in reported cases. Open-source ecosystem attacks have grown more sophisticated, with attackers installing information-stealing malware on developer terminals to harvest credentials for GitHub, npm, and other development management systems.
Ransomware-as-a-Service (RaaS) and Initial Access Broker (IAB) specialization have lowered barriers to entry for non-expert attackers. International hacktivist groups like RipperSec are using Telegram channels to publicly designate South Korean government agencies and businesses as attack targets, with the goal of degrading service availability and causing social disruption rather than stealing confidential information.
Governance controls
The Ministry of Science and ICT stated it would strengthen corporate information security capabilities, establish and operate an AI-based prevention and response system, and conduct proactive vulnerability discovery measures to create a trustworthy cyber environment for citizens.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.