The telecoms regulator said hackers used a Chinese address to plant a malicious code that shut down networks at six organisations on Wednesday.
Officials said they were continuing to investigate the origins of the attack.
North Korea has been blamed for previous attacks in 2009 and 2011.
"Unidentified hackers used a Chinese IP address to contact servers of the six affected organisations and plant the malware which attacked their computers," said Park Jae-moon of South Korea's communications regulator.
"At this stage, we're still making our best efforts to trace the origin of attacks, keeping all kinds of possibilities open," he said.
Officials stressed that the IP address did not reveal who was behind the attack, as hackers can route their attacks through addresses in other countries to obscure their identities.
Intelligence experts believe that North Korea routinely uses Chinese computer addresses to hide its cyber-attacks.
Korea's Communications Commission said that the attacks on all six organisations appeared to come from a single entity.
The networks had been attacked by malicious codes, rather than distributed denial-of-service (DDoS) attacks as initially suspected.
Â
The discovery has strengthened speculation that North Korea was behind the attack on Wednesday, the BBC's Lucy Williamson in Seoul reports.
A taskforce is being formed to analyse the virus and stop further attacks, and free computer vaccines have been handed out to South Korean companies, our correspondent adds.
Last week, North Korea accused the US and its allies of attacks on its internet servers.
.jpg)
The telecoms regulator said hackers used a Chinese address to plant a malicious code that shut down networks at six organisations on Wednesday.
