KakaoTalk Hit By North Korean Hackers

KakaoTalk Logo
Image Credit: Wikipedia 

 A new report by a South Korean cybersecurity company called Genians has found a case where North Korean hackers used Google accounts to take control of South Korean smartphones and tablets. They then used the victims' KakaoTalk messaging accounts to spread harmful software to their contacts. Citing other platforms, Malay Mail reported that there's more complexity in North Korea's internet spying efforts. They use normal digital tools and trusted social networks in ways that are harder to find or stop. The Straits Times says this shows a real danger that the feature might be used in advanced persistent threat (APT) attacks.

Key Details of the Cyberattack

Hacking Group: The attack is linked to the North Korean Konni APT (Advanced Persistent Threat) group, known for cyber espionage.

Initial Infiltration: Hackers first took over individual devices using a technique called spear-phishing. They pretended to be the National Tax Service in South Korea to trick victims into opening harmful files.

Google Account Exploitation: The hackers used Google's "Find My Device" service, which is typically for finding lost phones, to track the victim's location, send commands from a distance, and even reset the device. This made it hard to notice the attack and protected the hacker's presence on the device.

KakaoTalk As A Propagation Channel: After resetting the devices, the hackers accessed the users’ KakaoTalk accounts on their computers. They then used these accounts to send more harmful files to the victim's contacts. These harmful files were disguised as a "relaxation programme" or a "relaxation methods file".

Victims and Impact: One victim was a counselor who helps North Korean defectors. Some victims lost all their personal data, like photos, documents, and contact lists. There were worries the malware could allow remote monitoring using webcams and microphones.

Significance: Genians says this was a very complex and multi-layered attack. It shows North Korean cyber operations are getting more advanced, moving beyond stealing information to actually causing real problems by using trusted tools and social networks. Cybersecurity experts advise users to turn on two-factor authentication for accounts like Google and be careful about any suspicious files sent via messaging apps, even from people they know.

You can also read: Hacker Target Security Software Used by Remote Workers

About KakaoTalk

KakaoTalk (or KaTalk) is a popular messaging and service platform in South Korea. It is run by Kakao Corporation and has around 53.5 million monthly active users worldwide. It is the main messaging app in South Korea and has become a central part of daily life, business, and culture.

Beyond just messaging, KakaoTalk includes many services like online shopping, mobile payments, transportation, and entertainment. It is used by over 90% of South Korean smartphone users for communication, commerce, finance, and entertainment.

Deep Integration into Daily Life (The "Super App" Phenomenon)

KakaoTalk has more than just messaging. It includes a wide range of services that are all part of one app.

Communication Hub: It is the main way people in South Korea talk to each other, both in their personal and work lives.

Financial Services (Kakao Pay & Kakao Bank): The app includes digital wallet features (Kakao Pay) for buying and sending money, paying bills, and more. This expanded into Kakao Bank, the first internet-only bank in South Korea, which has become very popular.

Commerce (Kakao Commerce & Gifting): People can use KakaoTalk to shop, and a popular feature is "Gifting," where users can send digital or physical items, like coffee coupons, directly to friends through the app.

Transportation (Kakao T): The app includes services like ride-hailing (KakaoTaxi), public bus information (KakaoBus), and navigation, making travel more convenient.

Content and Entertainment: Kakao offers music streaming (MelOn), webtoons (KakaoPage), games (Kakao Games), and social media (KakaoStory), creating a large entertainment network.

Cultural Impact and Communication Patterns

KakaoTalk is so common in South Korea that it has influenced how people communicate and interact.

Ubiquitous Connectivity: Almost everyone in South Korea uses KakaoTalk, so it is the main way to connect with people, businesses, and even government agencies.

"Read Receipt" Culture: The app shows when people have read a message with a "1" badge that disappears when everyone has seen it. This leads to expectations for fast responses in both social and work settings.

Emoticons As A Language: People often use Kakao Friends characters in messages to express feelings, adding a playful and emotional layer to communication that cuts across language barriers.

Business Model and Monetization

Kakao Corporation makes money in many ways using its huge and active user base:

Advertising: They make money through targeted ads using platforms like "Kakao BizBoard."

E-commerce and Transaction Fees: Revenue comes from fees on transactions within their apps, like Kakao Pay and Gifting.

Digital Content: They also make income from selling digital items such as emoticons, premium themes, music subscriptions, and game accessories.

Business Solutions: Companies use services like "Kakao Alimtalk" and "Sangdam Talk" to interact with customers directly within the app.

Technical Infrastructure and Global Challenges

KakaoTalk uses a strong and flexible cloud system, managing thousands of virtual machines to handle billions of messages each day. Despite this success in South Korea, expanding globally has been tough because of competition from apps like WeChat in China and LINE in Japan and Southeast Asia. However, KakaoTalk is still popular worldwide and keeps improving features like end-to-end encryption for private chats.

Recent Cyberattacks in South Korea 

Throughout 2025, South Korea was hit by many serious cyberattacks, mainly from advanced North Korean hacking groups looking for financial and intelligence gains.

 These attacks affected millions of people and disrupted services in key sectors like telecommunications, finance, and the military, showing weaknesses in the country’s digital defenses.

Detailed Breakdown of Major 2025 Cyberattacks

Telecommunications Sector Breaches

In 2025, the two biggest telecom companies in South Korea, SK Telecom and KT Corp, were greatly affected. SK Telecom (SKT) Data Breach (April-May 2025): A complicated malware attack hit an internal server, leading to the theft of sensitive SIM card data for about 23 million customers, which is almost half the population. The hackers installed malicious software to steal the entire database over a long period. The incident caused a lot of public worry, led to an official government investigation, and resulted in nearly a million customers switching to other service providers in May 2025. SK Telecom was later fined for not managing customer data properly.

KT Corp Data Theft (September 2025): KT reported a separate breach that affected data from over 5,500 customers. This attack used a different method, where hackers installed fake base stations to eavesdrop on mobile traffic and steal personal information like IMSI, IMEI, and phone numbers.

Financial and Insurance Sector Attacks  

Financial institutions were a major target for ransomware and data theft.

Lotte Card Data Breach (August 2025): Hackers broke into Lotte Card's online payment servers, stealing about 200GB of data from around 3 million customers. The breach went unnoticed for 17 days, exposing credit card numbers and expiration dates.

Seoul Guarantee Insurance (SGI) Ransomware Attack (July 2025): This was the first time a ransomware attack caused full system failure at a Korean financial institution. The attack stopped important services like issuing and checking guarantees, which are necessary for the jeonse rental system. The company had to issue handwritten certificates to handle the disruption.

Welrix F&I Ransomware (August 2025): A branch of Welcome Financial Group was attacked by a Russian-linked group that claimed to have taken over a terabyte of internal files and shared some of them on the dark web.

Military and Espionage Targets  

North Korean groups linked to the state were more active in spying on South Korea's military and diplomatic organizations.

Military and Defense Industry Targeting (Ongoing): The South Korean military reported blocking more than 9,200 hacking attempts in the first half of 2025, a big increase.

Kimsuky Group Operations: The North Korea-linked Kimsuky group was very active, using advanced phishing tactics. In a July attack on a defense-related organization, they used AI-generated fake images as part of their plan to trick people. They also targeted at least 19 foreign embassies in Seoul by hiding malware in regular diplomatic emails. The group used a new, hard-to-detect backdoor called HttpTroy to take full control of infected systems.

Government and Industry Response  

The ongoing attacks showed that defenses were not well connected and there was no single organization ready to deal with threats quickly, leading to calls for a unified, rapid-response strategy. The government fined companies like SK Telecom for not doing enough to protect customer data, but some people said the fines were not high enough to help victims. The private sector, especially the growing cyber insurance market, saw more interest in better policies and risk management services because of the damage caused by these breaches.

South Korea worked with other countries and participated in joint exercises like the UK-led Cyber Marvel exercise to improve its defense against these ongoing and changing cybersecurity threats.