South Korean firm caught exporting satellite receivers with DDoS capabilities

A South Korean company has allegedly exported 240,000 satellite receivers with Distributed Denial-of-Service (DDoS) attack capabilities to an overseas client.

The Korean National Police Agency (KNPA) arrested the CEO and five employees of the satellite receiver manufacturing company after a tip-off from Interpol.

A criminal prosecution was started against the company and the employees, who were charged with violating South Korea’s cybersecurity laws. The police also issued an international arrest warrant for a foreign buyer associated with the case.

The probe began in July when Interpol raised suspicions that a company abroad was using satellite receivers manufactured by the South Korean firm equipped with the DDoS functionality.

Neither of the companies were named, but the authorities said the foreign company was involved in illegal broadcasting.

An analysis by the KNPA confirmed that the devices it used were either pre-installed with malware or modified via firmware updates after export.

The overseas company first started importing satellite receivers from the South Korean firm in 2017. In November of the following year, it is alleged to have requested the addition of DDoS capabilities, claiming it needed to counter DDoS attacks from competitors.

Between January 2019 and September 2024, the South Korean firm exported 240,000 satellite receivers to its foreign client. Of these, 98,000 had malware pre-installed at the time of the shipment, while the rest were distributed through firmware updates.

The firm made 6.1 billion Korean won ($4.35 million) in revenue from the illegal scheme. The police identified the profits as criminal proceeds and obtained a court order to freeze the company’s assets.

The KNPA is working with Interpol and other international agencies to track down the company’s foreign clients and bring them to justice.