KT found to have concealed malware infection on 43 servers last year

KT Corp. was found to have suffered malware infections on 43 servers last year but failed to report the incident to authorities, instead opting for internal remediation. The breach came to light only after investigators discovered traces of antivirus software scans during a forensic analysis.

Choi Woo-hyuk, director general of the Network Policy Bureau at the Ministry of Science and ICT and head of the joint public-private investigation team into the KT hacking incident, revealed the findings during an interim briefing on Thursday.

According to Choi, KT identified BPFDoor and web shell malware infections on its servers between March and July 2024, but handled the issue internally without notifying the government.

“The joint investigation team uncovered the issue during forensic analysis — KT had not disclosed it voluntarily,” Choi said. “We found evidence that KT had run antivirus software capable of detecting BPFDoor malware.”

Following the discovery, KT reported that some infected servers contained personal information, including names, phone numbers, email addresses, and IMEI device identifiers, according to the investigation team.

Choi emphasized that a complete forensic review is still required to determine the full extent of the breach, noting, “KT acknowledged that certain data was stored on the affected servers, and further investigation is necessary.”

Experts have raised concerns that the compromised servers may have leaked personal data used in unauthorized micro-payment schemes. Such transactions require information like names and birth dates, which cannot be obtained through illegal femtocell devices alone.

Choi said investigators are analyzing whether the stolen data could have been linked to these unauthorized payments, adding, “We will conduct a detailed investigation into any connections between the malware infection and the micro-payment incidents.”

The investigation team also stated that, so far, no evidence of authentication key leakage—which could allow SIM cloning—has been found. However, with additional breach cases identified, the probe may take longer than expected.

“As femtocell-based breaches are highly unusual, the analysis process requires considerable time,” Choi explained. “Recently discovered servers suspected of BPFDoor infection will undergo full forensic review. While it’s difficult to set a completion date, all available resources are being devoted to the investigation.”

Chiefs of Korea‘s top four conglomerates to rejoin FKI leade..

Hyundai taps Chinese tech leaders for autonomous driving pus..

Hyundai, Kia win brands, communication design prizes at Red ..

Samsung, Mercedes chiefs to batteries, chips in Seou..

Apple to debut burgundy iPhone 18 Pro year

K-beauty giant Amorepacific soars on solid Q3 earnings

Gov’t proposes to cut greenhouse gas emissions by up to 60%

CJ Logistics Q3 OP up 4.4% on seven-day delivery boost

AI-powered Korean education platforms expand globally

K-beauty exports hit record high, but brands show mixed resu..

Apple to debut burgundy iPhone 18 Pro year

Netmarble posts 39% profit surge on hit game Vampire

Lotte Shopping Q3 OP falls 15.8% amid weak grocery sales

K-beauty exports hit record high, but brands show mixed resu..

CJ Logistics Q3 OP up 4.4% on seven-day delivery boost

Hyundai, Kia win brands, communication design prizes at Red ..

Gov’t proposes to cut greenhouse gas emissions by up to 60%

Banks race to secure tech partners ahead of stablecoin legal..

Korean Air wins defense deal to localize drone parts

KT found to have concealed malware infection on 43 servers l..

LG Electronics launches endangered animal campaign in NY

Samsung to exhibit global art with Art TVs at Art Basel Paris

Hanwha showcases wheeled K9A2 self-propelled howitzer in U.S.

LG showcases integrated AI data center solution in Singapore

LG StanbyME 2 displayed in New York

Hyundai Motor unveils its newest Sonata The Edge

LG Electronics named official TV partner for U.S. Emmy Awards

Hanwha Life Financial to use Naver Pay insurance analytics

Korea launches rare-earth industry association