North Korean APTs Deploy Sophisticated Linux Toolkit Targeting South Korean Industries
A new Linux toolkit, featuring a HAProxy backdoor named 'ted backdoor' and a curl-based RAT, is being used by North Korean APTs to target South Korean media and automotive sectors for long-term espionage.
Rapid7 Labs has uncovered a sophisticated new Linux toolkit being deployed by North Korean advanced persistent threats (APTs) against organizations in South Korea's automotive and media sectors. This previously undocumented framework, which has evaded detection, includes a novel HAProxy backdoor dubbed 'ted backdoor' and a custom curl-based remote access trojan (RAT). The toolkit's capabilities allow threat actors to execute remote commands, inject malicious scripts into web traffic, harvest credentials, and conduct extensive surveillance, indicating a focus on long-term espionage.
The 'ted backdoor' is particularly noteworthy for its deep integration into the target environment. It is compiled as part of the victim's existing HAProxy installation, specifically version 2.8.12, and leverages HAProxy's native filter API. This allows it to intercept and manipulate traffic, hide its malicious activities from monitoring systems, and operate stealthily while legitimate load balancing functions continue uninterrupted. This sophisticated approach to evasion suggests a high level of technical proficiency and planning by the threat actors.
Complementing the HAProxy backdoor is a suite of other malicious tools, including an SSH keylogger designed to capture user credentials and a curl-based RAT. The RAT includes a watchdog thread that monitors the health of the HAProxy process, reporting its status back to the operator's command and control (C2) infrastructure. The earliest observed activity associated with this toolkit dates back to mid-2025, with the specific HAProxy build used in attacks compiled no earlier than November 22, 2024.
While attribution is made with medium confidence, the toolkit is linked to DPRK APTs due to the targeting of South Korean sectors, the use of simple XOR-based encryption and custom substitution ciphers, and C2 infrastructure patterns observed by threat intelligence platforms like ThreatFox and Maltrail. Researchers also note that the 'ted backdoor' might be part of a larger framework that could include a similar backdoor for Nginx. The plugin registers a custom HAProxy filter that hooks into the HTTP parser to inspect and log valuable traffic, steal session cookies, and selectively inject custom scripts into rendered webpages.
Technical analysis suggests that the campaigns, likely initiated in early 2025, aim for long-term cyber espionage. While the exact initial access vector remains unconfirmed, Rapid7 observed victims running edge web servers with exposed ports 80, 443 (hosting a Groupware login portal), and 25 (exposing a mail server). These services are consistent with documented Kimsuky (a DPRK-linked group) tradecraft, which has previously exploited RCE vulnerabilities in mail servers and targeted Groupware portals for credential harvesting.
The reconstructed attack chain posits that initial access is gained by exploiting vulnerabilities in the Groupware portal. Once inside the DMZ, the threat actor establishes persistence, harvests credentials using the SSH keylogger, and deploys a stager onto internal servers. This stager then checks for the presence of crond or HAProxy before deploying the CurlRAT, retrieving it from its data section or the edge webserver.
The 'ted backdoor' is deployed onto the HAProxy load balancer, establishing its own C2 channel for data exfiltration and command execution. It silently redirects or serves malicious content to selected clients, completing a watering-hole attack loop. The SSH keylogger captures plaintext passwords, encrypts them using a custom substitution cipher, and stores them. Similar encryption algorithms are used across other trojanized binaries, including polkitd, crond, agetty, and atd.
The CurlRAT stager uses a 1-byte XOR to decrypt its configuration, verifies root privileges, and profiles the OS to select the appropriate payload. It then overwrites the legitimate crond daemon and restarts the service, but only if HAProxy or cron are detected running on the system. This intricate and multi-stage approach highlights the evolving sophistication of North Korean cyber operations.
This new article provides further technical details on the 'ted' backdoor, including its sophisticated method of hiding within compiled HAProxy binaries and its ability to evade detection by erasing C2 requests from load balancer statistics. It also elaborates on the specific conditions required for the implant to serve modified pages to targeted visitors and details additional components of the toolkit, such as a trojanized SSH daemon and a companion RAT named curlRAT.
This new report from SecurityWeek provides further technical details on the 'ted backdoor' and its integration within HAProxy, noting that the backdoor is compiled as part of HAProxy version 2.8.12. It also elaborates on the initial access vector, which involved exploiting a Groupware login portal vulnerability, and details how the curl-based RAT, CurlRAT, polls its command and control server every 12 hours for instructions.
This new report details the specific technical mechanisms employed by the DPRK-linked threat actors, including the modification of HAProxy 2.8.12 to embed the 'ted' backdoor and the use of CurlRAT for command and control. It also highlights the presence of an SSH keylogger and altered system binaries like crond, agetty, and sshd, which are used to maintain persistence and evade detection.
This new analysis reveals that the North Korean APT group, with medium confidence attributed to APT37 (also known as InkySquid, ScarCruft, and Ricochet Chollima), is likely behind the attacks. The group's objectives appear to be twofold: information control and counterintelligence from targeting media outlets, and manufacturing technology intelligence from targeting automotive firms. The attackers specifically compromised HAProxy load balancers to deploy a new Linux toolkit, dubbed "TED," enabling long-term espionage operations including credential harvesting and log manipulation.