DPRK APT Infiltrates South Korean Firms via Backdoor Embedded in…

Rapid7 disclosed on September 3, 2026, a previously undocumented Linux toolkit—TED and curlRAT—used by North Korean APT groups for long-term espionage against South Korean media and automotive sectors. The compromise reaches the core of network infrastructure: the backdoor is statically compiled into HAProxy 2.8.12, turning the load balancer into an interception platform for SSL-terminated traffic.

{"main_topic":"cybersecurity","topics":["malware","linux","apt","infostealer","zero-day"]}

The activity dates to early 2025, with the first VirusTotal uploads appearing in mid-2025. The discovery demands a fundamental reassessment of security for network appliances traditionally excluded from EDR coverage.

Key Takeaways

Rapid7 attributes attacks against South Korean media and automotive sectors to North Korean APT groups with medium confidence, with activity dating to early 2025.
The TED backdoor is compiled as part of HAProxy 2.8.12-0fdb194, released November 22, 2024, and exploits the native filter API to intercept SSL-terminated traffic in plaintext without generating anomalous processes, connections, or logs.
The toolkit includes curlRAT with a dedicated watchdog, an SSH keylogger with custom encryption, a stager with timestomping, and six C2 handlers for command execution, reverse shell, and payload staging.
The counter-scrubbing mechanism for HAProxy log files indicates, in the researchers' words, "serious time reading HAProxy source code and testing against a live instance."

Why the Load Balancer Is the Perfect Target

The choice of HAProxy as an embedding vector is no accident. The open-source software handles SSL termination for all downstream applications, positioning it ideally for interception. TED leverages HAProxy's internal memory pools, event scheduler, and native process management to operate without additional processes, unexpected outbound connections, or log entries.

As the Rapid7 research team told Dark Reading exclusively, "from the attacker's standpoint, the load balancer is an ideal location because SSL terminates there, it sits in front of all applications, and load balancers are often excluded from endpoint detection coverage." The quote highlights a structural gap: network appliances remain blind spots for most traditional EDR platforms.

Persistence is achieved through trojanization of system binaries: crond, agetty, atd, polkitd, sshd. Timestomping aligns timestamps with those of /usr/bin/ssh. Filtered logs pass through /tmp/jasper-log. Selective deletion targets /root/.bash_history and /var/log.

TED in Detail: How the Interception Works

TED uses HAProxy's native filter API to insert itself into the request processing flow. The statically compiled backdoor accesses plaintext traffic at the SSL termination point, eliminating the need for man-in-the-host attacks on downstream machines. This mechanism represents, in the Rapid7 researchers' words, "a further step by embedding into production infrastructure rather than running alongside it."

The C2 responds via raw TCP socket, completely bypassing the logging subsystem. curlRAT's default polling interval is 43,200 seconds (12 hours), with a fast-poll mode reducible to 30 seconds. The retry loop allows 6 attempts at 5-second intervals. The command output buffer is capped at 1 MB.

The identified C2 infrastructure uses img.monderhouse.space as the primary domain and img.darklights.store as fallback. The api_token ecd427ea8330a4ff73618483e00b9b41 and the User-token header with victim ID complete the authentication protocol.

"Together, the two sectors suggest at least two concurrent objectives: information control and counterintelligence from the media side, and manufacturing technology intelligence from the automotive side" — Rapid7 researchers, via Dark Reading

Attribution and Investigation Limits

Rapid7 assigns medium confidence to the attribution to North Korean APT groups. The assessment rests on three converging elements: the selected targets, relatively simple obfuscation complexity, and C2 server correspondence with infrastructure documented for APT37, InkySquid, ScarCruft, and Ricochet Chollima. However, no infrastructure overlap has emerged that would isolate a single group at this stage.

The initial access vector remains unconfirmed. The hypothesis most consistent with documented tradecraft points to RCE exploitation of mail servers, consistent with Kimsuky patterns, but the primary vendor source explicitly labels the status as "unconfirmed pending further forensic evidence." Two analyzed victims ran edge web servers with ports 80, 443, and 25 exposed; port 443 hosted a Groupware portal, port 25 a mail server.

The campaign start timeline, estimated at early 2025, derives from the earliest VirusTotal uploads in mid-2025 and the release date of HAProxy 2.8.12-0fdb194 on November 22, 2024. This is not direct forensic confirmation.

Immediate Actions

Organizations with critical infrastructure in Asia-Pacific must immediately reassess the security posture of their network appliances. Four priorities emerge from the dossier:

Verify HAProxy binary integrity: compare hashes and signatures of current installations against official project release notes, particularly for build 2.8.12-0fdb194 and subsequent derivations.
Out-of-band log correlation: implement logging on a separate system unreachable from the HAProxy instance to detect scrubbing attempts or anomalous gaps in temporal patterns.
System process inspection: verify the integrity of system binaries such as crond, agetty, atd, polkitd, and sshd through verification mechanisms independent of the compromised host.
Raw socket traffic analysis: monitor TCP connections that bypass the appliance's logging subsystem, with particular attention to undocumented destinations.

Why This Marks a Shift in the Threat Model

The evolution documented by Rapid7 moves malware embedding from parallel runtime into the infrastructure component itself. This renders detection based on process and network anomalies—the dominant paradigm of modern EDR platforms—ineffective. The South Korean automotive sector, a critical node for V2X technologies and autonomous systems, becomes a target for manufacturing IP theft. The media sector exposes unpublished reporting and journalistic communications to counterintelligence.

The technical message is clear: SSL termination appliances are no longer mere infrastructure plumbing. They are the new critical frontier.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter