North Korean hackers compromise South Korean media and automotive networks via HAProxy

September 16, 2026 at 06:00 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

North Korean state-sponsored hackers have compromised South Korean media and automotive companies through the open-source HAProxy load balancer, gaining access to some networks since early 2025. Rapid7 attributed the attacks to APT37 with medium confidence, citing matching command-and-control servers and targeting patterns. The intrusions enabled credential harvesting, traffic redirection, and log tampering for long-term espionage.

Key Facts

Rapid7 attributed the attacks to North Korean APT37 with medium confidence based on targets, obfuscation, and matching C2 servers.
The attackers compromised HAProxy load balancers to install a Linux toolkit called TED, enabling full access to decrypted traffic.
Some victims have been compromised since early 2025, with operations including credential harvesting, drive-by downloads, and log modification.
The targeting of media and automotive sectors suggests objectives of information control, counterintelligence, and manufacturing technology theft.

Attack Attribution

Rapid7 attributed the campaign to North Korean APT groups with medium confidence, specifically linking it to APT37, also known as InkySquid, ScarCruft, and Ricochet Chollima. The attribution is based on the targeted sectors, use of simple obfuscation, and a list of command-and-control servers matching those previously used by APT37. Rapid7 researchers, who requested anonymity, noted that the focus on media companies could provide access to source networks, unpublished reporting, and journalist communications. Automotive companies, meanwhile, could serve as a gateway to manufacturing intellectual property and technology.

Compromise Method

The attackers compromised the open-source HAProxy load balancer, which is also the core of the enterprise offering HAProxy One. By exploiting the load balancer's filter API, the group gained direct access to already decrypted plaintext communication, avoiding the need for a host-in-the-middle attack. They installed a hard-to-detect Linux toolkit dubbed TED, which embeds into production infrastructure rather than running alongside it. Once resident in network appliances, the attackers conducted long-term espionage, including harvesting credentials, redirecting select users, conducting drive-by-download attacks, and modifying log files to hide their tracks.

Strategic Objectives

Rapid7's analysis suggests at least two concurrent objectives: information control and counterintelligence from the media side, and manufacturing technology intelligence from the automotive side. The attack fits a consistent DPRK pattern of initial access through trusted software or exposed infrastructure, long dwell times, credential harvesting, and watering-hole techniques targeting specific professional communities. North Korean hackers have previously targeted financial firms, accounting for the lion's share of cryptocurrency stolen in 2026. Other past attacks used deepfake military IDs and traditional spearphishing against South Korean embassy personnel.