North Korean Hackers Deploy New Linux Espionage Toolkit
North Korea-aligned threat actors deployed a sophisticated Linux toolkit called "ted backdoor" targeting automotive and media organizations in South Korea, as reported by Rapid7 The framework is deeply integrated into HAProxy version 2.8.12, using its native filter API, memory pools, and event scheduler to intercept and manipulate HTTP traffic while maintaining operational legitimacy The toolkit includes trojanized system utilities (agetty, crond, polkitd, sshd), a curl-based RAT, and an SSH key
Analysis
TL;DR
- North Korea-aligned threat actors deployed a sophisticated Linux toolkit called "ted backdoor" targeting automotive and media organizations in South Korea, as reported by Rapid7
- The framework is deeply integrated into HAProxy version 2.8.12, using its native filter API, memory pools, and event scheduler to intercept and manipulate HTTP traffic while maintaining operational legitimacy
- The toolkit includes trojanized system utilities (agetty, crond, polkitd, sshd), a curl-based RAT, and an SSH keylogger, enabling remote command execution, credential harvesting, and persistent surveillance
- Initial access was achieved through a Groupware login portal vulnerability, with the SSH keylogger serving as a staging server for lateral movement into internal networks
- Attack artifacts and infrastructure suggest links to APT37 and Lazarus groups, with techniques overlapping Operation SyncHole from the previous year
Why It Matters
This campaign demonstrates a sophisticated evolution in supply-chain-adjacent attack methodologies, where threat actors compromise widely-used infrastructure components like HAProxy to establish persistent, long-term surveillance capabilities. The use of legitimate load balancer internals for malicious purposes represents a significant advancement in evasion techniques that could affect organizations relying on similar proxy infrastructure globally.
Technical Details
- ted backdoor: A custom HAProxy plugin compiled directly into HAProxy version 2.8.12 source code, hooked into the built-in HTTP parser to intercept, inject, and manipulate HTTP traffic while hiding from monitoring systems
- CurlRAT: A curl-based remote access trojan that polls C2 servers every 12 hours, capable of decrypting and executing stored commands, deploying interactive PTY shells, and writing new configuration payloads to disk
- Trojanized utilities: Modified versions of standard Linux tools including agetty, atd, crond, polkitd, and sshd, with the stager checking for crond or HAProxy presence before deployment
- Evasion techniques: Used low-cost commodity TLDs, blended payload delivery with normal web browsing traffic, mimicked Naver's pstatic.net static content domain, and hid tampered page evidence from specific IP ranges
- Attack chain: Groupware portal exploitation → SSH keylogger deployment → credential harvesting → lateral movement → ted backdoor and CurlRAT installation on HAProxy load balancer
Industry Insight
- Organizations running HAProxy should immediately audit their installations for version 2.8.12 and verify binary integrity against official sources, as this represents a novel attack vector through legitimate infrastructure components
- Security teams should implement strict monitoring of HTTP traffic patterns on load balancers and establish baseline behavioral profiles to detect anomalous traffic interception or injection activities
- The overlap with known North Korean APT groups suggests continued targeting of South Korean critical infrastructure sectors, warranting enhanced threat intelligence sharing and proactive defensive measures across the automotive and media industries
Disclaimer: The above content is generated by AI and is for reference only.