North Korean APTs Deploy Sophisticated Linux Toolkit Targeting South Korean Industries
A new Linux toolkit, featuring a HAProxy backdoor named 'ted backdoor' and a curl-based RAT, is being used by North Korean APTs to target South Korean media and automotive sectors for long-term espionage.
Rapid7 Labs has uncovered a sophisticated new Linux toolkit being deployed by North Korean advanced persistent threats (APTs) against organizations in South Korea's automotive and media sectors. This previously undocumented framework, which has evaded detection, includes a novel HAProxy backdoor dubbed 'ted backdoor' and a custom curl-based remote access trojan (RAT). The toolkit's capabilities allow threat actors to execute remote commands, inject malicious scripts into web traffic, harvest credentials, and conduct extensive surveillance, indicating a focus on long-term espionage.
The 'ted backdoor' is particularly noteworthy for its deep integration into the target environment. It is compiled as part of the victim's existing HAProxy installation, specifically version 2.8.12, and leverages HAProxy's native filter API. This allows it to intercept and manipulate traffic, hide its malicious activities from monitoring systems, and operate stealthily while legitimate load balancing functions continue uninterrupted. This sophisticated approach to evasion suggests a high level of technical proficiency and planning by the threat actors.
Complementing the HAProxy backdoor is a suite of other malicious tools, including an SSH keylogger designed to capture user credentials and a curl-based RAT. The RAT includes a watchdog thread that monitors the health of the HAProxy process, reporting its status back to the operator's command and control (C2) infrastructure. The earliest observed activity associated with this toolkit dates back to mid-2025, with the specific HAProxy build used in attacks compiled no earlier than November 22, 2024.
While attribution is made with medium confidence, the toolkit is linked to DPRK APTs due to the targeting of South Korean sectors, the use of simple XOR-based encryption and custom substitution ciphers, and C2 infrastructure patterns observed by threat intelligence platforms like ThreatFox and Maltrail. Researchers also note that the 'ted backdoor' might be part of a larger framework that could include a similar backdoor for Nginx. The plugin registers a custom HAProxy filter that hooks into the HTTP parser to inspect and log valuable traffic, steal session cookies, and selectively inject custom scripts into rendered webpages.
Technical analysis suggests that the campaigns, likely initiated in early 2025, aim for long-term cyber espionage. While the exact initial access vector remains unconfirmed, Rapid7 observed victims running edge web servers with exposed ports 80, 443 (hosting a Groupware login portal), and 25 (exposing a mail server). These services are consistent with documented Kimsuky (a DPRK-linked group) tradecraft, which has previously exploited RCE vulnerabilities in mail servers and targeted Groupware portals for credential harvesting.
The reconstructed attack chain posits that initial access is gained by exploiting vulnerabilities in the Groupware portal. Once inside the DMZ, the threat actor establishes persistence, harvests credentials using the SSH keylogger, and deploys a stager onto internal servers. This stager then checks for the presence of crond or HAProxy before deploying the CurlRAT, retrieving it from its data section or the edge webserver.
The 'ted backdoor' is deployed onto the HAProxy load balancer, establishing its own C2 channel for data exfiltration and command execution. It silently redirects or serves malicious content to selected clients, completing a watering-hole attack loop. The SSH keylogger captures plaintext passwords, encrypts them using a custom substitution cipher, and stores them. Similar encryption algorithms are used across other trojanized binaries, including polkitd, crond, agetty, and atd.
The CurlRAT stager uses a 1-byte XOR to decrypt its configuration, verifies root privileges, and profiles the OS to select the appropriate payload. It then overwrites the legitimate crond daemon and restarts the service, but only if HAProxy or cron are detected running on the system. This intricate and multi-stage approach highlights the evolving sophistication of North Korean cyber operations.