A cyberattack on servers of South Korean broadcasters and banks on March 20 came from an Internet address in China.
South Korean regulators on March 21 said they believe the attack came from a "single organization," although it was too early to assign blame.
Suspicion, however, has fallen on North Korea, which has threatened to attack Seoul and Washington after Pyongyang was hit by more UN sanctions for its February 12 nuclear test.
Meanwhile, North Korea said on March 21 it would attack U.S. military bases on Japan and the Pacific island of Guam if provoked, a day after leader Kim Jong Un oversaw a mock drone strike on South Korea.
The North also held an air raid drill on March 21 after accusing the United States of preparing a military strike using bombers.
Based on reporting by AP and Reuters