The Internet Protocol address linked to the attacks was traced to a location in Shenyang, China, and a malicious code associated with the address was similar to the one used in North Korean cyberattacks against the South, the source had said.