My current understanding is that the malware was delivered as part of an update to some commonly used ActiveX controls. The initial infiltration took place 8 months ago, but the malware was designed to go live at a specific time [1]. Over 70 different pieces of malware were used to infiltrate a wide range of targets. The bash script was apparently used on non-Windows targets, of which there were only a few.

EDIT: The single most effective attack vector seems to have been the update server for an ActiveX control called XecureWeb, which is used by several banks and their 20 million customers [4]. Just checked and I have XecureWeb too, in a VM that I only use for online banking. Good thing I have that VM turned off 99% of the time.

According to SK news media, the primary reason the SK government suspects NK of the latest attack is because the attackers used some of the same malware, same proxy servers, and same techniques that were used in previous attacks, which the SK government also attributes to NK [2]. But AFAIK there is no indisputable evidence that links those previous attacks to NK, either. So there's a bit of circular reasoning involved in the accusation.

The initial accusation of a Chinese attack was based on a Chinese IP address (101.106.25.105) that was used by the attackers. This accusation was rescinded when it was found that one of the banks that were hacked have been using the same IP range in its internal network </facepalm> [3]. But even if this wasn't the case, the case for a Chinese attack would be weak because anyone can use a Chinese open proxy.

There was also mention of an North Korean IP address (175.45.178.x) being used for command & control [2], but I don't know how that works because SK ISPs are extremely unlikely to permit any traffic to or from NK IP addresses. Remember, this is a country that censors virtually every NK-operated website.

All in all, little direct evidence that links the attacks to NK has been released. Maybe such evidence exists but is classified. Maybe it doesn't exist in the first place. However, since the series of attacks over the last few years targeted SK's major financial, governmental, and media infrastructure, it is not too unreasonable to suspect that the attackers (or whoever hired them) have an axe to grind with SK as a whole, not with any particular corporation. Given the extremely polarized political landscape, it is also not unreasonable to suspect that someone who has a problem with SK might sympathize with NK.

What doesn't get mentioned amid all the finger-pointing and political rhetoric is that SK's internet infrastructure desperately needs a major overhaul. The so-called "security" companies, who sell ActiveX controls with various alleged benefits, have been in charge of IT policy for over a decade. This has led to an online landscape where it is considered normal for any random website to ask the user to restart IE as administrator and install 5 ActiveX controls just to be able to log in.

This is a completely separate problem from antiviruses. I'm not joking when I tell you that every bank requires you to install an ActiveX control that claims to detect and disable keyloggers. That's 1000x more evil than Norton Antivirus.

[1] http://news.khan.co.kr/kh_news/khan_art_view.html?artid=2013... [Korean]

[2] http://www.hani.co.kr/arti/economy/it/582269.html [Korean]

[3] http://www.hani.co.kr/arti/economy/it/579266.html [Korean]

[4] http://news.mt.co.kr/mtview.php?no=2013040922225524474&V... [Korean]

UPDATE: More links.

ADDENDUM: In a previous comment [5], I argued that Ahnlab is an upstanding company that is unlikely to be involved in malicious activities. Turns out one of their products actually was exploited during the latest attack, though it was not their flagship antivirus suite.

[5] https://news.ycombinator.com/item?id=5407719