Korea Fines KT for Rogue Femtocell Breach, Refers Both Carriers to Police

South Korea's privacy regulator fined KT Corp. ₩53.97 billion (approximately $37.6 million) on Wednesday and voted to refer both KT and rival LG Uplus to criminal investigators — not for being breached, but for what each company allegedly did afterward. KT deleted access logs from ten malware-infected servers while regulators were watching. LG Uplus allegedly decommissioned and reinstalled operating systems on key evidence servers after Korea's national cybersecurity watchdog had flagged a suspected intrusion. Exchange rate as of July 30, 2026; all KRW conversions in this article are approximate.

The dual referrals, approved at a July 29 plenary session of the Personal Information Protection Commission (PIPC), represent a significant escalation in South Korea's telecom enforcement posture. In the past, carriers that concealed breaches risked only a trivial administrative fine — a maximum of ₩30 million (approximately $20,883) for delayed notification. Now, for the first time, South Korea's privacy regulator has referred two of its three major mobile carriers to prosecutors for criminal investigation in the same week.

The breach that prompted KT's fine began in August 2024, when attackers acquired a lost KT-operated femtocell — a small, low-power cellular base station typically used to fill coverage gaps inside buildings — and extracted its authentication certificate. What made the attack possible was a systemic design failure: KT had deployed thousands of femtocells across its network using shared certificates stored in plaintext on each device, without root password protection and with SSH enabled for remote access .

Once attackers had the certificate, they cloned it onto counterfeit hardware and connected their rogue devices to the Seoul metropolitan area and surrounding Gyeonggi Province. KT's core network accepted the imposters as trusted devices — because the certificate matched. From that point, the attack exploited a fundamental feature of how cellular networks encrypt traffic. Mobile communications are encrypted only between the handset and the base station. Decryption happens inside the femtocell itself. An attacker who controls the hardware can read all traffic passing through it in plaintext, including IMSI numbers, IMEI identifiers, SMS messages, and phone call records. KAIST Professor Yongdae Kim, an IEEE Fellow and mobile security researcher , explained the structural implication of this design: the femtocell's internal decryption means any operator of that device has real-time visibility into every communication it handles.

The PIPC ordered KT to strengthen controls across its telecommunications equipment, expand the role of its Chief Privacy Officer, and obtain ISMS-P (Information Security Management System-Personal) certification for the affected network systems .

The femtocell breach was not the only security problem regulators uncovered when they inspected KT's infrastructure. During a full-scale examination of KT's servers, PIPC investigators found that 38 servers connected to personal information processing systems had been infected with multiple strains of malware, including BPFDoor — the Linux backdoor that also infected SK Telecom's network in a breach that exposed data linked to approximately 27 million users and resulted in a ₩134.7 billion (approximately $93.8 million) PIPC fine in August 2025.

BPFDoor is not conventional malware. It operates at the kernel level by attaching to the Linux Berkeley Packet Filter — a feature normally used by administrators for packet monitoring — and installs a custom filter that silently inspects all inbound network traffic. The backdoor does not open any network listening port, meaning routine port scans show nothing unusual. It activates only when it receives a specially crafted "magic packet" embedded in otherwise normal-looking traffic. Once triggered, it can open a reverse shell or redirect connections, allowing attackers to move laterally through the compromised network. Because it lives in system memory and deletes its binary after execution, post-incident forensic recovery is difficult.

PwC Threat Intelligence and Trend Micro have both attributed BPFDoor to Red Menshen, also tracked as Earth Bluecrow , a Chinese advanced persistent threat group with a documented pattern of targeting telecommunications providers across South Korea, Hong Kong, Myanmar, Malaysia, Egypt, and the Middle East. The presence of BPFDoor on servers at both SK Telecom and KT — South Korea's two largest mobile carriers — raises a question that neither company nor investigators has yet answered publicly: whether these are separate intrusions by the same actor, or artifacts of a single coordinated campaign against Korean carrier infrastructure.

KT was aware of the BPFDoor infections no later than March 2025, when malware was detected on its mobile servers. Internal security staff escalated findings to senior executives. Despite this, KT did not notify government authorities as required under the Personal Information Protection Act. A PIPC official stated: "KT was aware of the malware infection on its servers in March last year but failed to report the security breach to the government. During a full-scale inspection of KT's servers, we found signs suggesting an organized attempt to conceal the incident, including the deletion of logs from 10 compromised servers."

The PIPC voted to refer KT for criminal investigation on three grounds: failure to report the security breach, deletion of access logs from compromised servers, and submission of documents containing inaccurate information during the regulatory probe.

KT accepted the administrative fine and apologized. "We are rebuilding our personal information protection system from the ground up and expanding security investment to prevent similar incidents and restore customer trust," a company official said. The company stated it would review the regulator's written decision before deciding whether to challenge it in court.

The LG Uplus referral tells a different story — one in which the evidence needed to answer the most important questions may never be recovered.

South Korea's Korea Internet and Security Agency received an anonymous tip in July 2025 suggesting a possible breach of LG Uplus's internal systems. The carrier was notified. But LG Uplus did not formally report the incident to regulators until late October — a delay of roughly three months, during which a critical window of forensic evidence was closed.

The breach originated in LG Uplus's automated process policy management system, which controls access permissions across internal servers. A suspected third-party supply chain compromise allowed attackers to exfiltrate server configuration data, user authentication credentials, and employee records. The hacking publication Phrack subsequently claimed that attackers had infiltrated LG Uplus's intranet and leaked the personal data of approximately 42,000 customers and 167 employees , though the company has not confirmed those figures.

A separate KnownSec leak, in which more than 12,000 classified internal documents from a Beijing-based firm with government ties were posted briefly to GitHub, included evidence suggesting that LG U Plus call records had been stolen by a Chinese hacking group . The connection has not been officially confirmed.

What investigators found when they eventually gained access was that several key servers — including the company's integrated password management system — had been decommissioned or had their operating systems reinstalled between August 12 and September 15, 2025. This happened after KISA had alerted the carrier to the potential breach. One server submitted for forensic analysis showed inconsistencies with data provided by the original whistleblower, leading investigators to conclude that a second, undisclosed server had been the actual intrusion point — the one whose OS had been upgraded on August 12, making forensic recovery impossible.

Seoul Metropolitan Police had already raided LG Uplus's Magok headquarters in mid-2026, seizing servers and system data. The PIPC's July 29 police referral for suspected obstruction of official duties represents a further escalation on top of that existing criminal investigation.

The consequence of the evidence destruction reaches beyond the LG Uplus investigation itself. BPFDoor — found on SK Telecom's servers in 2025, and now found on 38 KT servers — has been attributed to a Chinese APT group that systematically targets Korean carriers. Whether LG Uplus was also infected with BPFDoor or a similar backdoor is now structurally unknowable: the servers where that evidence would have existed were wiped before investigators arrived. South Korea's three largest mobile carriers may all have been simultaneously compromised by the same threat actor, and the forensic record at one of them was destroyed before that question could be answered.

The KT and LG Uplus cases have exposed a structural paradox in South Korea's data protection enforcement framework.

Under the existing PIPA, the maximum administrative fine for failing to report a security breach within the required timeframe is ₩30 million (approximately $20,883) . The maximum fine for a confirmed breach — calculated at up to 3% of relevant annual revenue — can reach tens or hundreds of billions of won. The practical implication: a company that successfully conceals a breach faces only a trivial fine if caught, while a company that reports promptly triggers the full severity of the penalty regime because the breach is on record and cannot be minimized. Under this structure, concealment is financially rational.

South Korea's National Assembly passed amendments to PIPA in February 2026 , raising the maximum penalty ceiling to 10% of total annual revenue for the most serious violations — repeat offenses within three years, incidents affecting more than 10 million individuals, or breaches resulting from failure to comply with a prior regulatory order. Those amendments were signed into law in March 2026 and will take effect on September 11, 2026.

The KT fine was assessed under the existing 3% ceiling and landed at ₩53.97 billion (approximately $37.6 million) — significantly below the maximum of approximately ₩190 billion that the PIPC could theoretically have levied. Regulators cited factors including the scale of the breach relative to the SK Telecom and Coupang cases, the corrective measures KT had already taken, and the company's steps to compensate affected customers .

The PIPC has separately announced plans to pursue legislative reform that would introduce explicit criminal penalties specifically for evidence concealment during data breach investigations. The KT and LG Uplus cases appear to have been the direct catalyst.

The July 29 actions leave South Korea in a situation with no clear precedent in its telecom regulatory history: all three major mobile operators under active regulatory or criminal scrutiny at the same time.

SK Telecom, which disclosed the largest breach in April 2025 and was fined ₩134.7 billion (approximately $93.8 million), is challenging that fine in Seoul Administrative Court . KT is now subject to both an administrative fine and a criminal probe for log deletion. LG Uplus faces an ongoing police investigation and the new PIPC referral for server evidence destruction.

Exchange rate used: USD 1 = ₩1,436.59 (mid-market, July 30, 2026). All KRW-to-USD conversions in this article are approximate and subject to change.

BPFDoor is a Linux backdoor attributed to Red Menshen (also called Earth Bluecrow) , a Chinese advanced persistent threat group that has targeted telecoms across South Korea, Hong Kong, Myanmar, and other countries. Unlike conventional malware, BPFDoor installs itself at the kernel level using the Linux Berkeley Packet Filter, opens no listening ports, and activates only on receipt of a specially crafted "magic packet" hidden in ordinary network traffic — making it essentially invisible to standard security tools. It was found on SK Telecom's servers in the breach disclosed in April 2025, and investigators found it on 38 KT servers in the current case. The same malware appearing at South Korea's two largest carriers raises the question of whether a coordinated campaign targeted multiple carriers simultaneously. That question cannot be definitively answered for LG Uplus, because the relevant servers were wiped before investigators could examine them.

LG Uplus decommissioned and reinstalled the operating systems on key servers — including its integrated password management system — between August 12 and September 15, 2025, after South Korea's national cybersecurity watchdog had already flagged a potential breach and notified the company. That timing is the basis for the PIPC's referral for suspected obstruction of official duties. Practically, it means that the forensic evidence that would have shown how attackers entered LG Uplus's systems, what data they accessed, and whether malware such as BPFDoor was present on carrier servers has been permanently destroyed. Seoul Metropolitan Police had already raided the company's headquarters before the PIPC referral, but the evidence gaps created by the server wipes cannot be filled retroactively.