Cyber Op Targets South Korean Media & Automotive Sectors

A Load Balancer Turned Wiretap

Researchers at Rapid7 have documented a previously undocumented Linux espionage toolkit, assessed with medium confidence to be the work of a North Korea-aligned advanced persistent threat (APT) group, embedded inside HAProxy load balancers at two South Korean organizations in the media and automotive sectors. Rather than exploiting a software vulnerability, the operators appear to have gained code-execution access to the host and quietly recompiled a trojanized HAProxy binary containing a custom backdoor the researchers named "ted." Because load balancers are the point where HTTPS traffic is decrypted before being forwarded to backend servers, the implant gave the attackers a clear view of everything passing through — while the load balancer kept doing its normal job, with connection counters scrubbed to hide any trace of the intrusion.

Dark Reading first flagged the campaign, describing a toolkit built for long-term surveillance that combines the HAProxy plugin with trojanized versions of core Linux system utilities.

Incident Overview

Inside the "Ted" Backdoor

According to Rapid7's technical writeup, "ted" is not a bolt-on tool — it is compiled directly into the HAProxy 2.8.12 source tree and hooks the load balancer's native HTTP parser and filter API. The plugin operates at the level of HAProxy's internal HTX buffer (its parsed HTTP storage region), using the software's own memory pools, event scheduler, and process-management infrastructure to blend in with legitimate traffic handling.

The implant activates when it sees a request for a specific hardcoded path (a decoy image filename), at which point it switches into command-and-control mode and accepts a small set of numeric opcodes covering:

• A system beacon that reports the build ID, HAProxy version, and worker-mode status
• File upload and download
• Arbitrary command execution via popen(), with output captured over stderr
• Configuration updates with built-in validation

To stay hidden, "ted" rewrites HAProxy's internal connection counters (fields like beconn, feconn, cum_conn, bytes_in, and bytes_out) using struct offsets hardcoded for version 2.8.12 — erasing any evidence of the C2 traffic from the load balancer's own statistics and backend logs. It can also inject or replace content in HTTP response bodies while adjusting headers to avoid tipping off byte-range requests that might expose a size mismatch.

curlRAT, the SSH Keylogger, and the Stager

The backdoor doesn't operate alone. Rapid7 documented three supporting components trojaned into everyday Linux system binaries:

• curlRAT — a libcurl-based RAT masquerading as legitimate daemons (crond, atd, agetty, polkitd). It runs two threads: one polling for operator commands (roughly every 12 hours by default, with a fast-poll mode available), and one dedicated to watching HAProxy's own health and reporting status back to the operator.
• SSH keylogger — captures plaintext SSH credentials during authentication and writes them, encrypted with a custom substitution cipher, to a hidden path under /var/lib/sshd/.
• Stager — the deployment mechanism. It fingerprints the target OS (Rapid7 observed CentOS 7.7-7.9 and Ubuntu 22.04 hosts), selects the matching payloads, overwrites the legitimate binaries, and timestomps the replacements to match the original file's creation time so a directory listing looks unremarkable.

curlRAT supports command modes for remote execution, configuration writes, staged payload installation, a reverse shell (which escalates via setuid(0) before handing off), a system-info beacon, and a full interactive pseudo-terminal shell.

Evasion and Anti-Forensics

The toolkit's operators went well beyond hiding inside a legitimate process. Rapid7 catalogued a deliberate anti-forensics routine that:

• Filters known-bad keywords (references to tmp, wget, cron) out of system logs via a staging file designed to look like a leftover JSP artifact
• Selectively erases .bash_history and standard log paths (/var/log/messages, audit.log, secure, syslog, auth.log)
• Checks for a virtualization indicator before running the HAProxy watchdog thread, aborting if the host doesn't look like a real production box — a sandbox-evasion guardrail
• Uses layered custom cryptography rather than off-the-shelf encryption: a chained XOR seeded from the first byte of a file, combined with a custom substitution alphabet for configuration data, and a separate rolling-XOR-plus-Base64 scheme for C2 traffic

None of this required a memory-corruption exploit or a zero-day. Initial access appears to have come from direct code execution on internet-facing edge servers exposing a Groupware login portal and mail service, consistent with credential compromise or exploitation of a web-facing application rather than a novel HAProxy vulnerability.

Command-and-Control Infrastructure

Rapid7 identified a cluster of C2 domains registered under low-cost, commodity top-level domains, several of which were styled to resemble legitimate content-delivery subdomains — one imitated the naming convention of Naver's pstatic.net static-content CDN, a pattern intended to blend malicious callbacks into ordinary South Korean web-browsing traffic. curlRAT authenticates to its C2 with a hardcoded API token, and generates a per-victim ID by hashing a combination of the shell version string, hostname, IP address, and hardware UUID.

Attribution: APT37, Lazarus, or Both?

Rapid7 is explicit that attribution here is not confirmed and should be read as an assessment, not a fact. The medium-confidence lean toward APT37 (also tracked as ScarCruft, believed to operate under North Korea's Ministry of State Security) rests on several threads: C2 domains that overlap with infrastructure ThreatFox and maltrail have previously associated with APT37, the targeting of Korean Groupware software, and the group's documented history of simple XOR/substitution-cipher tradecraft and watering-hole delivery.

Complicating the picture, the campaign's timeline and delivery pattern also overlap with Operation SyncHole, a watering-hole campaign against South Korean media targets that has been attributed to Lazarus Group — a separate North Korean cluster generally assessed to operate under different state sponsorship than APT37. Rapid7 stops short of resolving which cluster is responsible, noting the overlap "illustrates the complexity of attributing this campaign to a specific North Korean group," and frames the broader judgment — a North Korean-linked actor is likely responsible — with appropriately hedged language rather than firm attribution to either named group.

Why This Matters

Load balancers and reverse proxies sit at a structurally privileged point in modern web architecture: they terminate TLS, see every request before it's routed, and are rarely included in the same endpoint-detection coverage as application servers. A backdoor compiled directly into the load balancer's own source — rather than dropped as a separate malicious file — is difficult to catch with signature-based tooling and nearly invisible to log review, since the implant edits the very counters an operator would check for anomalies.

For defenders running HAProxy or similar edge infrastructure, Rapid7's findings point toward a few concrete checks:

1. Verify binary provenance. Confirm production HAProxy binaries match official upstream builds (checksums, reproducible builds, or package-manager provenance) rather than trusting an in-place binary because the service is "just working."
2. Audit crond, atd, agetty, polkitd, and sshd for unexpected modification times or size drift — the toolkit specifically targets these for daemon replacement.
3. Don't rely solely on HAProxy's own connection/traffic counters for anomaly detection; this campaign demonstrates they can be selectively falsified from inside the process.
4. Restrict and monitor code-execution paths to edge/DMZ hosts, since the reported entry point was direct host access via exposed Groupware and mail services rather than an HAProxy-specific exploit.
5. Watch outbound traffic to CDN-styled subdomains on cheap TLDs, particularly domains mimicking well-known regional CDNs.

References

• Rapid7 — DPRK APTs: Ted Backdoor and curlRAT Target South Korean Media and Automotive Sectors
• Dark Reading — Cyber Op Targets South Korean Media, Automotive Sectors
• SecurityWeek — North Korean Hackers Deploy New Linux Espionage Toolkit