North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
Product
curlRAT
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 4, 2026
- Last mentionedSep 7, 2026
Timeline
2 articles · newest firstDPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
68
Appears with
- ted backdoorproduct · 2
- ted backdoormalware · 2
- curlRATmalware · 2
- HAProxyproduct · 2
- APT37threat actor · 2
- Rapid7vendor · 2
- Rapid7organization · 1
- SSH keyloggermalware · 1
- South Korean media organizationsvictim · 1
- Lazarusthreat actor · 1
- Kimsukythreat actor · 1
- South Korean automotive organizationsvictim · 1
- HAProxyvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.