"The attacks on Korean and US internet sites were traced back to circuits originating in China," Won Sei-hoon, the South's spy chief, was quoted by Yonhap news agency on Friday.
"North Korea's communications ministry has been confirmed as leasing the line."
South Korea's National Intelligence Service declined to confirm the Yonhap report.
In early July, the websites of the presidential Blue House, the South Korean defence ministry and Shinhan Bank were among several sites hit.
Access to Naver, one of South Korea's leading internet portals, was also disrupted.
The Korea Information Security Agency said the attacks appeared to be linked to an ongoing attack against government websites in the US, including sites for the US treasury and the Secret Service.
The US attacks began on July 4, the US Independence Day holiday.
According to the agency, initial investigations showed the attacks appeared aimed only at paralysing access to the sites, rather than hacking into secure networks or stealing information.
North Korea was immediately suspected of involvement in the attacks but there has been little concrete evidence.
Denial of service
South Korean media reported at the time that the North ran an internet warfare unit that tries to hack into US and South Korean military networks to gather confidential information and disrupt service, and that Pyongyang has between 500 and 1,000 hacking specialists.
The US and South Korean cases involve what are known as denial-of-service attacks, in which an unusually high number of computers all try to connect to a single website at the same time.
That deluge of requests overwhelms the server handling the traffic, in effect shutting it down.
Mounting such an attack can be relatively easy using widely available hacking programs, but they can be made far more serious if hackers infect and use thousands of computers – often without owners' knowledge - tied together into "botnets".
South Korea is one of Asia's most wired nations, with two-thirds of its population connected to high-speed internet services.