A North Korea-aligned threat actor has been using a new Linux-based espionage toolkit to target automotive and media organizations in South Korea, according to research published by Rapid7. The framework is designed for long-term, stealthy surveillance rather than smash-and-grab data theft.
A Backdoor Compiled Into the Load Balancer Itself
At the center of the toolkit is a custom HAProxy plugin the researchers call the “ted” backdoor, compiled directly into a HAProxy 2.8.12 instance running in the victim’s environment. Rather than running as a separate malicious process, it hooks into HAProxy’s native filter API, internal memory pools, event scheduler and HTTP parser, letting it intercept and inject traffic while genuine load-balancing operations continue normally, which helps it evade routine monitoring.
The broader framework also includes trojanized versions of common Linux utilities, including agetty, atd, crond, polkitd and sshd, along with a curl-based remote access tool the researchers call CurlRAT and an SSH keylogger that doubles as a staging server. CurlRAT polls its command-and-control server roughly every 12 hours and can decrypt and execute stored commands, write new configuration payloads to disk, or spawn a full interactive shell.
Initial Access and Attribution
Rapid7 says the attackers first gained access to an edge server by exploiting a vulnerability in a groupware login portal, then used the SSH keylogger to harvest credentials for lateral movement into internal systems. Once installed, the ted backdoor let attackers redirect or serve malicious content to selected visitors browsing through the compromised load balancer, using low-cost commodity domains designed to blend in with legitimate traffic, in one case mimicking a Naver static-content domain.
Rapid7 says the toolkit has likely been in use since late 2024, based on the release date of the first HAProxy version it was compiled against. Attack infrastructure and techniques observed overlap with watering-hole methods previously used by APT37 and Lazarus, and the campaign’s timeframe overlaps with Operation SyncHole, a watering-hole campaign against South Korean firms attributed to Lazarus in 2025 — pointing toward a North Korean state-linked actor, though Rapid7 stops short of formal attribution to a specific named group.
Leave a Reply