6.25 DNS DDOS Attack In Korea

Shortly after 10:00am Jun 25th 2013, many government websites from South Korea were not accessible. It was actually caused by the malware performing ddos attack on 2 major DNS servers (ns.gcc.go.kr and ns2.gcc.go.kr).

During the investigation, we managed to find the original attack sample which was served by a compromised website at that time ...