Korea arrests CEO for adding DDoS feature to satellite receivers

South Korean police have arrested a CEO and five employees for manufacturing over 240,000 satellite receivers pre-loaded or later updated to include DDoS attack functionality at a purchaser's request.

While neither company has been named, the two companies have been trading since 2017. In November 2018, the purchasing company made a special request to include DDoS functionality, with the South Korean manufacturer complying.

Allegedly, the functionality was needed to counter the attacks of a competing entity.

The exact way the DDoS functionality was leveraged on the devices was not specified, but these attacks are always illegal when targeting external systems.

Moreover, users of the satellite receivers were involuntarily taking part in attacks and might have experienced reduced device performance during these occurrences.

From January 2019 to September 2024, the manufacturer of the devices shipped 240,000 satellite receivers, 98,000 of which had a DDoS module pre-installed. The rest received the functionality through a later firmware update.

The Korean police uncovered the malicious scheme following the reception of intelligence from Interpol, while the action also impacted a suspect who was placed on an international wanted list.

"In July, Interpol provided intelligence suggesting that "illegal broadcasting company (Company A, foreign-based) imports satellite receivers equipped with DDoS attack functions from a Korean company (Company B)," reads the announcement.

"An analysis of the equipment revealed that DDoS functionality was being installed during firmware updates."

The six individuals who were arrested in Korea now face charges relating to violations of the Act on Promotion of Information and Communications Network Utilization and Information Protection.

Moreover, the court has also approved the seizure of the company's assets and the confiscation of 61 billion KRW ($4,350,000), the amount the firm estimated to have made by selling the malicious satellite receivers.

The company's operators who purchased the equipment remain free, and the Korean police seek international cooperation to track and apprehend them.