North Korean Hackers Deploy New Linux Espionage Toolkit Targeting South Korea’s Automotive and Media Industries
A sophisticated new Linux toolkit has been deployed by North Korea-aligned threat actors to carry out long-term surveillance on automotive and media organizations in South Korea. The framework, revealed by cybersecurity firm Rapid7, consists of a custom HAProxy instance called ‘ted backdoor’ and trojanized versions of essential system tools, designed to evade detection and persist within the victim’s infrastructure.
The toolkit’s primary purpose is to facilitate remote command execution, credential harvesting, and script injection into web traffic. This enables attackers to spy on victims for extended periods without being detected. According to Rapid7, the framework is deeply integrated within the target environment, with the ted backdoor compiled as part of the HAProxy version 2.8.12 running on the victim’s system. The toolkit utilizes HAProxy’s native filter API and internal memory pools to intercept traffic and hide from monitoring, ensuring that legitimate load balancing traffic operates as expected.
Initial access was gained by exploiting a vulnerability in a Groupware login portal, allowing the attackers to reach an edge server. From there, they used an SSH keylogger to harvest credentials, enabling lateral movement to internal systems. The toolkit also employs a curl-based remote access tool (RAT), which polls the command and control (C&C) server every 12 hours for commands. Based on these instructions, it can decrypt and execute commands stored in its configuration, decode and write a new config payload to disk, or deploy a full interactive shell.
The ted backdoor is a custom HAProxy plugin compiled within the source code of HAProxy, directly hooked into the balancer’s built-in HTTP parser. It enables intercepting and injecting HTTP traffic, executing C&C tasks, and achieving persistence among other malicious activities. As part of the observed attacks, the threat actor used domains registered under low-cost top-level domains (TLDs) and blended the payload delivery traffic with normal web browsing, mimicking Naver’s pstatic.net static content domain.
The toolkit was likely in use since late 2024, when the first involved HAProxy iteration was released. Attack artifacts point to watering-hole techniques previously used by APT37 and Lazarus, suggesting that a North Korean threat actor might be behind this campaign as well. The overlap with Operation SyncHole, attributed to Lazarus last year, further supports this hypothesis.
The emergence of this sophisticated toolkit highlights the ongoing evolution of nation-state sponsored hacking groups. To protect against such threats, it is essential for organizations to maintain robust security measures, including regular vulnerability assessments and penetration testing. Furthermore, users should be cautious when accessing public networks or using shared devices, as these can serve as entry points for attackers.
In light of this development, individuals and organizations must remain vigilant and stay informed about the latest cybersecurity threats and trends. By doing so, they can take proactive steps to protect themselves against such sophisticated attacks and maintain their digital security in an increasingly complex threat landscape.
Source: SecurityWeek — 2026-09-07