A stealthy new Linux-based toolkit targeting South Korean automotive and media firms has been uncovered. The framework embeds a backdoor in HAProxy to enable long-term, undetected surveillance.

  • North Korean actors utilized a custom 'ted backdoor' integrated into HAProxy 2.8.12.
  • Primary targets include high-value automotive and media organizations in South Korea.
  • The toolkit features CurlRAT and SSH keyloggers for credential harvesting and lateral movement.

According to a detailed report by Rapid7, North Korean-aligned threat actors have deployed a highly advanced Linux toolkit designed for long-term espionage. The framework is specifically engineered to remain undetected by embedding itself within critical network infrastructure, allowing attackers to maintain a persistent presence within target environments for months or even years.

The core of this operation is the 'ted backdoor', a custom plugin compiled directly into the source code of HAProxy version 2.8.12. By leveraging the native filter API and internal memory pools of the load balancer, the backdoor can intercept and inject HTTP traffic without disrupting the legitimate flow of data, effectively bypassing most standard monitoring tools.

Read Also:Visa Enhances Cybersecurity Portfolio with AI-Driven Vulnerability Management

Why This Matters

BozokMedia analysis shows that this shift toward modifying legitimate system binaries—such as 'agetty', 'crond', and 'sshd'—represents a significant escalation in stealth tactics. By compromising the very tools used for system administration, the attackers create a 'ghost' presence. This level of integration suggests that the threat actors have deep knowledge of Linux internals, making traditional antivirus and EDR solutions less effective.

The initial breach was achieved by exploiting a vulnerability in a Groupware login portal. Once access was gained, the attackers deployed an SSH keylogger to harvest credentials, facilitating lateral movement into the internal network. This was followed by the deployment of CurlRAT, a curl-based Remote Access Trojan that polls a Command and Control (C&C) server every 12 hours for instructions.

"The integration of a backdoor directly into the load balancer's HTTP parser is a masterclass in stealth, turning a security asset into a surveillance tool."

Evidence recovered from the attack artifacts strongly links this campaign to APT37 and the Lazarus Group. The techniques used, including watering-hole attacks and the use of low-cost commodity TLDs, mirror those seen in the previous 'Operation SyncHole' attributed to North Korean state-sponsored actors.

Did You Know?: The attackers mimicked Naver’s 'pstatic.net' domain to blend their malicious payload delivery traffic with normal web browsing, making it nearly invisible to network analysts.

Frequently Asked Questions

Q1: What is the 'ted backdoor'?
It is a malicious custom plugin embedded within HAProxy that allows attackers to intercept web traffic, steal cookies, and execute remote commands.

Q2: How did the attackers enter the system?
They exploited a vulnerability in a Groupware login portal to gain initial edge server access before moving laterally using stolen credentials.