North Korea's Linux Espionage Toolkit Deepens Threat

South Korean automotive and media organizations have been under surveillance by a new Linux-based espionage toolkit, according to research from Rapid7. The framework, designed for covert, long-term monitoring, is built around a trojanized HAProxy instance and other backdoored system tools. The findings indicate a shift in tradecraft, where attackers are increasingly embedding themselves within the very infrastructure they target.

A Deeply Embedded Backdoor

At the heart of the toolkit is what Rapid7 calls the 'ted backdoor', a custom plugin compiled directly into HAProxy version 2.8.12, which was found running in the victim's environment. This integration is not superficial; the backdoor leverages HAProxy's native APIs, including its filter API, internal memory pools, event scheduler, and process management infrastructure. This allows it to intercept and inject HTTP traffic while remaining undetected.

As Rapid7 explains, the plugin is so well integrated that genuine load-balancing traffic continues to operate normally, while the backdoor silently carries out its malicious tasks. This deep level of integration makes the backdoor particularly difficult to spot, as it blends in with legitimate HAProxy operations. The toolkit also includes trojanized versions of standard Linux utilities such as 'agetty', 'atd', 'crond', 'polkitd', and 'sshd', broadening its capabilities for credential harvesting and other espionage activities.

HAProxy: A New Attack Surface

The use of HAProxy as a persistence mechanism represents a notable development in the threat landscape. HAProxy is a widely used, open-source load balancer and proxy server, making it an attractive target for attackers seeking long-term covert access. The 'ted backdoor' is not a separate binary but is compiled within the HAProxy source code, hooking directly into the balancer's built-in HTTP parser. This design means that the backdoor inherits the performance and stealth of the legitimate server software, allowing it to handle high traffic volumes without raising suspicion.

Rapid7 researchers noted that this approach offers attackers significant advantages. The backdoor can achieve persistence, execute C&C tasks, and intercept traffic, all while appearing as a normal part of the HAProxy process. This level of sophistication suggests that the threat actor is constantly evolving to find new ways to compromise enterprise infrastructure and maintain a foothold without detection.

Initial Access and Lateral Movement

The attack chain began with the exploitation of a vulnerability in a Groupware login portal, which served as the initial entry point to an edge server. From there, the attackers deployed an SSH keylogger, which also functioned as a staging server. This tool was used to harvest credentials, allowing the attackers to move laterally to internal systems. The modular nature of the toolkit is evident in how each component plays a specific role in the infection and espionage process.

During the deployment phase, a stager is used to check for the presence of either crond or HAProxy on the system. Only after confirming the environment does it deploy CurlRAT, a curl-based remote access trojan (RAT), retrieving it either from its data section or the edge web server. In parallel, the ted backdoor is dropped onto the HAProxy load balancer. This parallel deployment ensures that the attackers establish both a covert channel for command and control and a mechanism for web traffic manipulation.

CurlRAT: A Tool for Persistent Control

CurlRAT, the curl-based RAT used in these attacks, is a key component of the espionage framework. It is designed to poll a command-and-control (C&C) server every 12 hours for new instructions. Based on these commands, it can decrypt and execute commands stored in its configuration, decode and write a new configuration payload to disk, or deploy a full interactive PTY shell. This level of flexibility allows the attackers to adapt their operations in real-time, depending on the opportunities they find on the compromised network.

According to Rapid7, the RAT is not just a simple backdoor but is designed for stealth and longevity. By polling infrequently, it reduces its network footprint, making it harder for security tools to detect. The ability to execute commands and spawn interactive shells gives the attackers full control over the compromised system, enabling them to steal sensitive data, move laterally, and conduct further reconnaissance without raising alarms.

Evasion and Disguise Techniques

The threat actors behind this campaign have employed several sophisticated evasion techniques. They used domains registered under low-cost commodity top-level domains (TLDs) to host their C&C infrastructure, which is a common but effective way to avoid detection. More notably, they blended their payload delivery traffic into normal web browsing by mimicking Naver's pstatic.net static content domain. This technique, which involves making malicious traffic look like legitimate requests for static web content, can easily bypass security filters that do not scrutinize traffic to trusted domains.

Rapid7's analysis of the attack artifacts suggests that the group's tactics, techniques, and procedures (TTPs) are consistent with those used by APT37 and Lazarus, both of which are North Korean state-sponsored hacking groups. The campaign timeframe also overlaps with Operation SyncHole, a Lazarus operation that was reported last year. These similarities suggest that a North Korean threat actor is likely behind this latest campaign, although Rapid7 has not definitively confirmed the specific group.

The toolkit is designed to achieve several espionage objectives, including stealing cookie sessions and credentials, redirecting selected users to malicious sites, and conducting drive-by download attacks. It also has the ability to hide evidence of the tampered page from a specific range of IP addresses, which allows the attackers to avoid detection by security researchers who might be monitoring the compromised site.

Key Technical Details

• The ted backdoor is a custom HAProxy plugin compiled within HAProxy version 2.8.12.
• The stager deploys CurlRAT only after checking for the presence of crond or HAProxy.
• CurlRAT polls the C&C server every 12 hours for new commands.

Long-Term Espionage Operations

Rapid7's report indicates that the toolkit was likely in use since late 2024, when the first involved HAProxy iteration was released. This suggests that the threat actor has been conducting this campaign for several months, underscoring the patience and persistence often associated with state-sponsored espionage. The toolkit's design, with its emphasis on stealth and long-term control, is not suited for quick smash-and-grab operations but rather for sustained intelligence gathering.

In a statement, Rapid7 explained how the multiple components work together to maintain stealth and functionality: "Ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection." This quote highlights the dual purpose of the toolkit: to covertly gather intelligence while also being able to launch additional attacks when needed.

Implications for Targeted Organizations

For organizations in South Korea — particularly those in the automotive and media sectors — this report serves as a stark reminder of the persistent threat posed by North Korean state-sponsored hackers. The deep integration of the backdoor into HAProxy means that even organizations with robust perimeter defenses may be compromised if they run vulnerable versions of this common software. The use of legitimate system tools and the blending of malicious traffic with normal web activity make this type of attack particularly challenging to detect and mitigate.

The findings also highlight the importance of maintaining up-to-date software and patching known vulnerabilities, as initial access was gained through a flaw in a Groupware login portal. Regularly monitoring for unusual network activity, particularly outbound connections to suspicious domains, could help organizations spot the early stages of such an attack. However, the stealth techniques employed by this threat actor mean that even vigilant defenders may need to rely on advanced threat hunting and behavioral analytics to uncover these intrusions.

As this campaign demonstrates, the threat from North Korean hacking groups extends beyond traditional targets like financial institutions or government agencies. The focus on automotive and media companies suggests that these groups are interested in a wide range of intellectual property and sensitive business information. This report should prompt organizations in these sectors to review their security postures and consider whether they have adequate measures in place to defend against such sophisticated espionage tools.

The discovery of this new toolkit is a clear signal that North Korean cyber actors continue to invest in developing covert and effective tools to compromise their targets. By integrating their backdoors into popular open-source software like HAProxy, they are finding new ways to bypass security controls and maintain long-term access to their victims' networks. For defenders, this means that staying ahead of these threats requires not only up-to-date intelligence but also a proactive approach to identifying and mitigating unusual behavior within their own systems.