 |
Photo courtesy of Yonhap News |
[Alpha Biz= Kim Jisun] SEOUL, November 6 (local time) — South Korea’s KT Corp. failed to report a major malware infection that struck its internal servers in 2024, according to findings by a joint government–private investigation taskforce announced on Wednesday. The probe revealed that some of the infected servers contained personal data of subscribers, including names, phone numbers, and device identifiers.
The investigation, jointly conducted by the Ministry of Science and ICT and National Intelligence Service (NIS), found that KT discovered the infections—caused by “BPFdoor” and “web-shell” backdoor malware—between April and July 2024 but did not report the incident to authorities, as required by South Korea’s Information and Communications Network Act. The violation is subject to an administrative fine of up to ₩30 million (≈ US $22,000).
According to the taskforce, KT internally removed the malware by executing custom cleanup scripts rather than disclosing the breach.
“Evidence showed traces of BPFdoor had been wiped, which is why it was not detected during the nationwide inspection conducted after the SK Telecom hacking incident,” said Choi Woo-hyuk, Director of Network Policy at the Ministry of Science and ICT.
“However, digital forensics confirmed antivirus-related activities on 43 servers, suggesting KT was aware of and attempted to handle the infection internally.”
The government is conducting further forensic analysis to determine the full scope and impact of the intrusion, including potential data leakage. KT has acknowledged that subscriber information—including names, phone numbers, email addresses, and IMEI identifiers—was stored on some of the compromised servers.
The BPFdoor malware, a Linux-based backdoor, can remain dormant until activated by a “magic packet” from external attackers. The same exploit technique was reportedly used in a SIM-data breach at SK Telecom in April 2024, although investigators have yet to confirm whether the two incidents were carried out by the same threat actor.
Separately, the taskforce attributed the unauthorized micropayment hacking incidents linked to illegal femtocell (micro-base-station) devices to KT’s poor internal-network access controls and oversight failures in its femtocell operations.
Alphabiz Reporter Kim Jisun(stockmk2020@alphabiz.co.kr)
