North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.
60
Vendor
HAProxy
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 7, 2026
- Last mentionedSep 8, 2026
Timeline
2 articles · newest firstNorth Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
Appears with
- curlRATmalware · 2
- APT37threat actor · 2
- Rapid7vendor · 2
- Rapid7organization · 2
- ted backdoormalware · 2
- Lazarus Groupthreat actor · 1
- ted backdoorproduct · 1
- Lazarusthreat actor · 1
- CurlRATproduct · 1
- HAProxyproduct · 1
- HAProxy 2.8.12product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.