North Korean hackers deploy Linux espionage toolkit against South Korean firms

September 7, 2026 at 05:12 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

North Korea-aligned hackers deployed a new Linux espionage toolkit against automotive and media organizations in South Korea, Rapid7 reported. The framework, active since late 2024, uses a backdoored HAProxy and trojanized system tools to intercept traffic and harvest credentials. The campaign blends malicious traffic with legitimate web activity to evade detection.

Key Facts

Rapid7 identified the toolkit in attacks targeting automotive and media organizations in South Korea.
The toolkit includes a backdoored HAProxy instance called 'ted backdoor' and trojanized versions of agetty, atd, crond, polkitd, and sshd.
The campaign has been active since late 2024, when the first involved HAProxy iteration was released.
Initial access was gained by exploiting a vulnerability in a Groupware login portal.
The CurlRAT component polls its command-and-control server every 12 hours for commands.

Toolkit Components

The framework consists of a HAProxy instance called 'ted backdoor' and trojanized versions of tools such as agetty, atd, crond, polkitd, and sshd. The ted backdoor is a custom HAProxy plugin compiled within the HAProxy source code and directly hooked into the balancer's built-in HTTP parser. It uses HAProxy's native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring. The toolkit also includes a curl-based remote access trojan called CurlRAT, an SSH keylogger, and a stager. CurlRAT polls the command-and-control server every 12 hours and can decrypt and execute commands, decode and write a new config payload to disk, and deploy a full interactive PTY shell.

Attack Chain

Initial access to an edge server was obtained through exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems. The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer. The backdoor establishes command-and-control communication for data exfiltration, script injection, and command execution, while the balancer starts redirecting or serving malicious content to selected clients.

Evasion Techniques

The threat actor used domains registered under low-cost commodity top-level domains and blended payload delivery traffic into normal web browsing. The malicious traffic mimicked Naver's pstatic.net static content domain. The ted backdoor and CurlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs.