Significant security lapses found in malware-hit KT Corp

Investigation led by South Korean authorities revealed that leading mobile carrier KT Corp. had hidden multiple malware infections and breaches that resulted in a recent cyberattack involving illegal micro base stations, according to the Yonhap News Agency.

Despite discovering customer data exposure stemming from BPFDoor malware compromise across 43 of its servers between March and July 2024, KT opted to manage the incident internally rather than immediately informing authorities of the attack, findings from the joint government-private investigation team showed.

KT's femtocell management also had several critical flaws that enabled unauthorized connections to its internal network. Malicious femtocells linked to KT's network, which facilitated end-to-end encryption deactivation, then allowed the procurement of payment authentication details, said the investigators. KT, which could be penalized for such security gaps, has already committed to bolstering its defenses.

"KT will faithfully cooperate with the government-led investigation into unauthorized micropayment breach cases and make all-out efforts to ensure network security and protect customers," the firm said.