Hacker News Reader

The attack code wasn't in an advert, suggesting the Korean news organisation had either previously been attacked, or had an insider plant this code.

This attack was done by North Koreans. The site is a North Korean propaganda advertising site, which is visited a lot by South Korean researchers.

That would explain the strange/weak infrastructure and the economic targets in APAC.