North Korean Hackers Deploy New Linux Espionage Toolkit

Summary

North Korea-aligned threat actors are utilizing a new Linux toolkit for long-term surveillance, targeting automotive and media organizations in South Korea. The sophisticated framework includes a HAProxy backdoor named 'ted backdoor' and trojanized system utilities, enabling remote command execution, credential harvesting, and script injection. The toolkit's deep integration into the victim's infrastructure and its use of techniques similar to APT37 and Lazarus Group suggest a persistent and stealthy espionage campaign.

Full text

North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports. Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. The toolkit supports remote command execution, credential harvesting, and script injection into web traffic, enabling attackers to spy on victims for long periods of time without detection. According to Rapid7, the framework is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected,” the cybersecurity firm explains. Likely in use since late 2024, when the first involved HAProxy iteration was released, the toolkit also uses a curl-based RAT, an SSH keylogger, and a stager.Advertisement. Scroll to continue reading. Initial access to an edge server was obtained through the exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems. “The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer,” Rapid7 explains. The backdoor establishes C&C communication for data exfiltration, script injection, and command execution, and the balancer starts redirecting or serving malicious content to selected clients browsing through it. CurlRAT, the curl-based RAT deployed in the attacks, polls the C&C every 12 hours for commands. Based on these, it can decrypt and execute commands stored in its configuration, decode and write a new config payload to disk, and deploy a full interactive PTY shell. The ted backdoor is a custom HAProxy plugin compiled within the HAProxy source code, directly hooked into the balancer’s built-in HTTP parser. It can intercept and inject HTTP traffic, execute C&C tasks, and achieve persistence, among others. As part of the observed attacks, the threat actor used domains registered under low-cost commodity top-level domains (TLDs) and blended the payload delivery traffic into normal web browsing, mimicking Naver’s pstatic.net static content domain. “Ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection,” Rapid7 notes. Attack artifacts recovered by the cybersecurity firm, along with the infrastructure used, point to watering-hole techniques previously used by APT37 and Lazarus, and the campaign timeframe overlaps with that of Operation SyncHole, attributed to Lazarus last year, which suggests that a North Korean threat actor might be behind this campaign as well. Related: US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks Related: US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers Related: EU Targets Russian Intelligence Officers Accused of Running Cyber Spying Campaign Related: China, India-Linked Hackers Both Targeted Same Pakistani Police Force Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Sangoma Switchvox Vulnerabilities Exploited in the Wild12-Year-Old PostgreSQL Vulnerability Enables Database, Server TakeoverVMware Workstation and Fusion Updates Patch Critical VulnerabilityGoogle Patches 6th Chrome Zero-Day of 2026Manchester Airports Group Data on 8.8 Million People Leaked After Ransom RefusalHiddenLayer Raises $100 Million for AI Runtime Security153 Million Driver License Images Offered on Dark WebOver 3 Million WordPress Sites Affected by Migration Plugin Vulnerability Latest News Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day ExploitsOpenAI Agents Hijack Another Victim WebsiteAdobe Commerce Zero-Day Exploited to Backdoor Online StoresModified ScreenConnect Clients Used in Worm-Like CampaignElementor Pro WordPress Plugin Vulnerability Exploited to Hack SitesIn Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B ValuationHPE Patches Critical RCE Vulnerabilities in AOS-CXOpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveFrank Verdecanna has been appointed Chief Financial Officer at Armadin.Keeper Security has named Jessica Krowel and Bill Grabner as SVPs of sales for North America.Skyhigh Security has named Anthony Palladino as Chief Operating Officer.More People On The MoveExpert Insights What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — ted backdoor
• malware — CurlRAT
• domain — pstatic.net

Entities