South Korean authorities have uncovered a major cybersecurity breach involving satellite receivers manufactured with hidden DDoS attack capabilities. The operation, which began in 2017, led to the arrest of a CEO and five employees from a Korean manufacturing company.

The scheme produced 240,000 satellite receivers, with 98,000 units containing pre-installed DDoS modules and the remainder receiving attack capabilities through firmware updates. The manufacturing was initiated after a foreign company requested DDoS functionality in November 2018, allegedly for defensive purposes against competitor attacks.

The investigation, triggered by Interpol intelligence, revealed a complex operation between two companies: a foreign-based importer (Company A) and a Korean manufacturer (Company B). The scheme violated the Information and Communications Network Protection Act, resulting in the seizure of assets worth 61 billion KRW ($4.35 million).

While Korean authorities have apprehended the manufacturers, the foreign company’s operators remain fugitives, prompting international law enforcement cooperation. This case represents a significant security breach where consumer electronics were transformed into potential cyber weapons, with users unknowingly experiencing device performance issues during attacks.