North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.
- ted backdoor compiled into HAProxy 2.8.12, hooked into its native HTTP parser for stealth
- CurlRAT polls C&C every 12 hours, can deploy interactive PTY shell
- Initial access via exploited Groupware login portal; SSH keylogger harvested credentials
- Payload traffic mimics Naver's pstatic.net; low-cost TLD domains used
- Attribution overlaps Lazarus's Operation SyncHole and prior APT37 watering-hole activity
- Products
- HAProxyCurlRATted backdoor
- Malware
- ted backdoorCurlRAT
- Organizations
- Rapid7
- Countries
- North KoreaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | pstatic.net | elivery traffic into normal web browsing, mimicking Naver’s pstatic.net static content domain. “Ted backdoor and curlRAT were desig |
From the original article
2 min read at securityweek.com
The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.