Malware News Rapid7 observed DPRK-linked APTs deploying a ted backdoor and curlRAT via a compromised South Korean edge groupware/HAProxy, enabling stealth traffic

[Khushal]

Content source

https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors/

Overview​

A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance.

The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.

Operating alongside this are an SSH keylogger, a curl-based RAT, and a stager. The RAT maintains a watchdog thread dedicated to tracking HAProxy’s health, and reporting it back to the operator’s infrastructure. The earliest uploads on VirusTotal date back to mid-2025 and the involved HAProxy 2.8.12-0fdb194 was released on 22 November 2024, establishing this as the earliest possible compilation date for this build.

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. This previously undocumented framework, enabled threat actors to execute remote commands on compromised servers, inject malicious scripts...

www.rapid7.com

The toolkit is attributed with medium confidence to DPRK APTs, given that the attacks Rapid7 observed were targeting South Korean media and automotive sectors, likely aiming at long-term espionage, the usage of simple xor-based encryption, custom substitution cipher, and the list of C2s hardcoded is associated to APT37 by ThreatFox and maltrail. Analysis shows that the ted backdoor could be part of a broader framework covering nginx backdoor as well. The ted plugin registers a custom HAProxy filter that hooks the HTTP parser to inspect and log high-value traffic, steal session cookies, and perform a client IP selection to decide whether to inject custom scripts in the webpage being rendered.

 

[Bot]

Assessment

This is a significant report because the attackers appear to have modified legitimate Linux infrastructure components rather than deploying only standalone malware. A compromised HAProxy binary or plugin can provide both traffic visibility and a relatively inconspicuous execution point while normal load-balancing functions continue.

The attribution should remain appropriately qualified. Targeting South Korean organizations, code similarities, and infrastructure overlaps can support a DPRK/APT37 assessment, but they do not independently prove operator identity. Likewise, the VirusTotal submission dates and HAProxy release date establish useful timing indicators, not necessarily the complete development or intrusion timeline.

Defensive priorities

Organizations running HAProxy or the affected Linux services should consider:

• Compare installed HAProxy, sshd, crond, agetty, atd, and polkitd packages against trusted vendor repositories and independently verified hashes.
• Inspect HAProxy configuration files, dynamically loaded modules, filters, startup arguments, systemd units, cron entries, and recently modified executable files.
• Review SSH authentication logs, authorized_keys files, shell histories, web-server logs, and outbound connections from the affected hosts.
• Look for unexpected processes, watchdog threads, unusual child processes, and connections to the C2 indicators published in the Rapid7 report.
• Preserve disk and memory evidence before removing suspicious files. Deleting a backdoor without collecting evidence can destroy useful indicators and timeline data.
• Rotate passwords, SSH keys, API tokens, cookies, and other credentials from a known-clean system if credential theft or session-cookie harvesting is plausible.
• Treat a host with modified system binaries as potentially fully compromised. For high-value systems, rebuilding from trusted media is generally safer than attempting a selective cleanup.

A normal process name or valid-looking package version is not sufficient evidence of integrity. Verification should include package ownership, cryptographic hashes, file metadata, loaded modules, startup configuration, and network behavior.

The full technical indicators and behavioral details should be taken from Rapid7’s original report rather than inferred from the summary:

Source

Rapid7 Labs report