North Korea-Aligned Actors Use New Linux Espionage Toolkit Against South Korean Organizations
Summary
Rapid7 describes a Linux espionage toolkit targeting South Korean automotive and media organizations, combining a custom HAProxy backdoor, CurlRAT, and an SSH keylogger. Artifacts suggest possible links to North Korean actors.
Key points
- Rapid7 reports attacks against automotive and media organizations in South Korea, with the toolkit likely in use since late 2024.
- Initial access to an edge server came through exploitation of a Groupware login portal vulnerability; harvested SSH credentials enabled lateral movement.
- The toolkit includes a custom HAProxy plugin called ted backdoor, trojanized system tools, CurlRAT, an SSH keylogger, and a stager.
- Ted backdoor hooks into HAProxy’s HTTP parser to intercept or inject traffic, execute commands, communicate with command-and-control infrastructure, and persist.
- CurlRAT polls command-and-control every 12 hours and can execute commands, write configuration payloads, and deploy an interactive PTY shell.
- The tools support credential and cookie-session theft, data exfiltration, targeted redirects, drive-by downloads, and efforts to evade detection.
- Rapid7 says recovered artifacts and infrastructure resemble techniques previously used by APT37 and Lazarus; overlap with Operation SyncHole suggests, but does not confirm, a North Korean connection.
Article Details
- Attack Vectors
- The attackers reportedly gained initial access to an edge server by exploiting a vulnerability in a Groupware login portal.
- A stager checked for crond or HAProxy before deploying CurlRAT, retrieving it from its data section or the edge web server.
- A trojanized SSH keylogger harvested credentials and also served as a staging server; the stolen credentials enabled lateral movement to internal systems.
- The ted backdoor, compiled into HAProxy, intercepted and injected HTTP traffic and enabled command execution, data exfiltration, and delivery of malicious content to selected clients.
- CurlRAT polled command-and-control every 12 hours and could execute configured commands, write a new configuration payload, and deploy an interactive PTY shell.
- The toolkit was designed to steal cookie sessions and credentials, redirect selected users, and conduct drive-by download attacks.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe ted backdoor used its C&C communication to support data exfiltration.T1056.001 · KeyloggingThe SSH keylogger captured credentials in the targeted environment.T1059.004 · Unix ShellCurlRAT could deploy an interactive PTY shell for command execution.T1105 · Ingress Tool TransferThe stager retrieved CurlRAT from its data section or the edge web server before deploying it.T1189 · Drive-by CompromiseThe toolkit was reported to conduct drive-by download attacks against selected users.T1539 · Steal Web Session CookieThe toolkit was designed to steal victims' cookie sessions.
Malware
CurlRAT“The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server.ted backdoorDesigned for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’.
Products
Countries
North KoreaNorth Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports.South KoreaNorth Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports.
Industries
AutomotiveNorth Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports.MediaNorth Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports.