North Korean Hackers Deploy Stealthy Linux Espionage Toolkit in South Korea
A sophisticated new Linux espionage toolkit has been spotted in the wild, used by North Korea-aligned threat actors to target automotive and media organizations in South Korea. The framework, designed for long-term surveillance, consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of common Linux tools such as ‘agetty’, ‘atd’, and ‘sshd’. This stealthy toolkit allows attackers to spy on victims undetected for extended periods.
The toolkit’s architecture is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment. It leverages HAProxy’s native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and evade monitoring. Meanwhile, genuine load balancing traffic operates as expected, making it challenging for security teams to detect malicious activity.
Initial access to an edge server was obtained through a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used to harvest credentials, enabling lateral movement to internal systems. The stager checks for the presence of either crond or HAProxy and only then deploys CurlRAT, a curl-based remote access tool (RAT), from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer.
The ted backdoor establishes command and control (C&C) communication for data exfiltration, script injection, and command execution. The balancer starts redirecting or serving malicious content to selected clients browsing through it. CurlRAT polls the C&C every 12 hours for commands, which can decrypt and execute commands stored in its configuration, decode and write a new config payload to disk, and deploy a full interactive pseudo-terminal (PTY) shell.
The threat actor used domains registered under low-cost commodity top-level domains (TLDs) and blended the payload delivery traffic into normal web browsing. This mimics Naver’s pstatic.net static content domain, making it difficult for security teams to detect malicious activity.
Rapid7 notes that the toolkit was designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of tampered pages from a specific range of IPs to evade detection. Attack artifacts recovered by the cybersecurity firm point to watering-hole techniques previously used by APT37 and Lazarus.
The campaign’s timeframe overlaps with that of Operation SyncHole, attributed to Lazarus last year, which suggests that a North Korean threat actor might be behind this campaign as well. This highlights the ongoing threat posed by North Korea-aligned cyber actors in targeting critical infrastructure and compromising sensitive information.
As a result, organizations should be vigilant about potential vulnerabilities in their infrastructure and regularly review and update their security measures to prevent similar attacks. Moreover, awareness of watering-hole techniques and the use of low-cost commodity TLDs can help security teams detect and mitigate these types of threats more effectively.
Source: SecurityWeek — 2026-09-07