North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.
60
Malware
ted backdoor
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 4, 2026
- Last mentionedSep 8, 2026
Timeline
4 articles · newest firstNorth Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
Security Affairs newsletter Round 593 by Pierluigi Paganini
Security Affairs weekly newsletter round 593 linking to dozens of stories across breaches, ransomware, malware, APTs, and AI security news.
15
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
68
Appears with
- curlRATmalware · 4
- Rapid7vendor · 3
- APT37threat actor · 3
- HAProxyproduct · 2
- HAProxyvendor · 2
- curlRATproduct · 2
- Rapid7organization · 2
- ted backdoorproduct · 2
- FBIorganization · 1
- PaperCutproduct · 1
- Kasperskyvendor · 1
- SonicWall SMA 1000product · 1
- ESETvendor · 1
- Lazarusthreat actor · 1
- Kimsukythreat actor · 1
- Mirage Kittenthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.