North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.
60
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 4, 2026
- Last mentionedSep 8, 2026
Timeline
4 articles · newest firstNorth Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
65
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
68
Appears with
- curlRATmalware · 4
- Rapid7vendor · 4
- HAProxyproduct · 3
- ted backdoormalware · 3
- ted backdoorproduct · 2
- Kimsukythreat actor · 2
- HAProxyvendor · 2
- Rapid7organization · 2
- curlRATproduct · 2
- Lazarus Groupthreat actor · 2
- Kasperskyvendor · 1
- HAProxy 2.8.12product · 1
- Mandiantvendor · 1
- South Korean media organizationsvictim · 1
- SSH keyloggermalware · 1
- tedmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.