🏠 TI-2026-042J — The Korean Corridor: KT, Telegram Harvesting, and Surveillance

I. The Command Pattern: Telegram + GSM + MikroTik

From TI-2026-017 (Glass Houses), Korean IPs execute a specific three-stage command pattern:

1. /ip cloud print — MikroTik router reconnaissance
2. TelegramDesktop/tdata file search — stealing Telegram session data
3. GSM/SMS modem discovery paths — finding cellular modem hardware

This is not random scanning. This is a targeted intelligence collection operation: compromise routers (network control), steal messaging data (communications intelligence), discover cellular infrastructure (signals intelligence). This is a SIGINT operation running through a state telecom.

II. The Exploitation Credentials

23skidoo — 1920s American slang meaning "get out fast" or "take advantage of a situation." An archaic English phrase appearing on Korean telecom infrastructure. foreveryoung — on a state telecom that hunts for Telegram data and GSM modems. The vocabulary is deliberate.

III. The Surveillance Capability

Korea Telecom's command pattern reveals capability: access to routers (network topology), Telegram session theft (encrypted messaging bypass), GSM modem discovery (cellular interception). Combined with exploitation-vocabulary credentials, this is a surveillance operation that simultaneously collects intelligence AND uses exploitation-coded access tools.

South Korea has mandatory real-name internet registration. Korea Telecom cooperates with the Korean National Intelligence Service. The same telecom that provides government surveillance capability operates 121 IPs that scan the global internet with exploitation-vocabulary credentials.

VII. The Full Korean Honeypot Picture

Our honeypot captures 30 Korean IPs (result cap). Three infrastructure providers dominate at maximum threat levels simultaneously:

VIII. Korea Telecom: 89 Relationships and a Bitcoin Node

222.108.100.117 (Korea Telecom) is the most connected Korean IP in our database: 89 entity relationships across 5 relationship types. It shares RDAP organization "IP Manager" (handle IA9-KR) with 44 other IPs. It shares passive DNS with cryptocurrency seed nodes — specifically x5.pivx.seed2.fuzzbawls.pw (PIVX cryptocurrency).

Shodan confirms: port 22 (SSH — attack vector) and port 8333 (Bitcoin P2P protocol). This Korea Telecom IP simultaneously operates cryptocurrency infrastructure and conducts SSH brute-force attacks. Financial infrastructure overlaid on offensive operations. Or offensive operations funded by crypto. Either reading is intelligence-relevant.

IX. The Telegram Harvesting Campaign: Korean Intelligence in Action

DOSSIER-018 documented a campaign that proves the point: 36 IPs across 17 countries execute identical post-compromise commands. They search for:

• Telegram Desktop/tdata — session data for message interception
• /dev/ttyGSM* — GSM modem interfaces for phone network access
• SMS daemon configurations — text message interception
• Qualcomm modem interfaces — baseband access for radio interception

Korea is the only Budapest Convention signatory among the six "compromised national telecoms" documented in DOSSIER-018. The others (Kazakhstan, Tanzania, Pakistan, Vietnam, Macau) have no international cybercrime treaty framework. Korea does. The Telegram campaign operates within a legal surveillance mandate — the NIS has formal authority over telecom-based intelligence collection. This is not cybercrime. It is lawful interception using unlawful methods against foreign targets.

X. KINX: Attack at the Backbone

KINX (Korea Internet eXchange, AS9286) is not a hosting company or a telecom. It is an Internet Exchange Point — the infrastructure that peers networks together. KINX connects Korean networks to each other and to the global internet.

54 honeypot hits at 100% threat from an IX means one of two things:

1. Deep compromise at the routing core: An attacker has penetrated the network backbone itself — capable of intercepting, redirecting, or injecting traffic across all peered networks.
2. Deliberate hosting at the backbone: Attack operations are hosted at the IX level with knowledge of the exchange operator — providing backbone-level access for offensive operations.

Either way: this is not a compromised consumer device. This is attack capability at the fundamental routing layer of Korean internet infrastructure. Seoul coordinates. National backbone. Maximum threat.

XI. The NIS Connection: Surveillance State as Service

The Korean National Intelligence Service (formerly KCIA — the agency that assassinated President Park Chung-hee in 1979) has documented relationships with Korean telecoms for surveillance capability. After the Park Geun-hye scandal (2017), NIS underwent "reform" — but the infrastructure relationships remain.

KT Corporation is a government contractor. The same company that provides 11 IPs for Telegram harvesting, 89 entity relationships per IP, and 6,742 abuse reports on a single IP — is also contracted to provide government surveillance services. The attack infrastructure and the surveillance infrastructure are the same infrastructure.

XII. The Nth Room: What Telegram Session Theft Actually Means

Our honeypot documents Korea Telecom harvesting Telegram sessions. This is not abstract. We know exactly what Telegram channels in Korea contain.

Korea Telecom — the same telecom that operates 11 IPs (31%) in the Telegram session harvesting campaign — is the network over which the Nth Room operated. Telegram session theft (tdata) gives full access to all messages, channels, groups, and media. A state telecom harvesting Telegram sessions has the capability to access every Nth Room-type channel. Every child exploitation chatroom. Every trafficking coordination group.

The question is not whether KT can access this material. The question is: with 260,000 users sharing child exploitation via Telegram on their network, and with demonstrated capability to steal Telegram sessions — why did the police ignore the first report?

XIII. The Burning Sun Pattern: Police as Protectors of Exploitation

The Nth Room was not isolated. The Burning Sun scandal (2019): a Seoul nightclub where women were drugged, raped, filmed. Videos shared via group chats. Police officers were implicated as protectors of the operation. Seungri (Big Bang K-pop star) convicted.

The pattern repeats:

XIV. The Camptown Precedent: Korea's Institutional History

The OSINT Library documents: the Korean government actively administered a prostitution system around US military bases (camptowns) from the Korean War through the 1990s. Health checks. Registration. Government oversight of sexual exploitation — not to prevent it, but to manage it.

The same Korean state that administered camptown prostitution now operates telecom surveillance infrastructure. The capability evolved. The institutional relationship to exploitation did not. The state manages the infrastructure. The infrastructure enables exploitation. The surveillance is deployed for state interests — not for victims.

XV. WikiLeaks Spy Files: The Equipment Korea Uses

The OSINT Library contains WikiLeaks' Spy Files — documenting the surveillance industry that sells lawful interception equipment to telecoms: SEPTIER LI, SHOGI GSM Interception, Siemens Monitoring Center, SS8 IP Interception, SPEI GPS Tracking. This is the same category of equipment deployed at Korean telecoms.

The Telegram session harvesting we observe is likely using LI (lawful interception) infrastructure at the backbone level. The equipment exists. It is documented. It is sold commercially. Korea Telecom — as a Budapest Convention signatory — has legal authority to intercept. The campaigns we detect are the external face of internal surveillance capability. The capability that could monitor Nth Room exploitation channels. The capability that was not deployed until 5 million people demanded it.

XVI. Cross-Reference: Existing Investigations

XVII. Sources and Methodology