DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux Daemons Against South Korean Media and Automotive Sectors

DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' (TL-2026-2329) is a high-severity malware campaign, first published 2026-09-04. It is attributed to APT37 (North Korea) with medium confidence, affects HAProxy Technologies HAProxy, maps to 18 MITRE ATT&CK techniques (T1027, T1036.005, T1059.004), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-2329

Threat ID
TL-2026-2329
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-04
Last reviewed
2026-09-04
Attribution
APT37
Attribution confidence
MEDIUM
Nation-state nexus
North Korea
Motivation
ESPIONAGE
Target sectors
news - media, automotive
Target regions
south korea, East Asia
Detection rules
9
Indicators of compromise
26

Malware and tooling in DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted'

Malware and tooling: CurlRAT, Ted

Rapid7 disclosed a DPRK-nexus intrusion set (medium confidence, suspected APT37, possibly Lazarus Group) using a custom HAProxy 2.8.12 filter plugin called 'Ted' to intercept HTTP traffic, steal session cookies, and deliver watering-hole payloads, alongside 'CurlRAT' — a family of trojanized Linux system daemons (crond, agetty, atd, sshd, polkitd) providing remote command execution and reverse-shell access — plus an SSH keylogger that hooks the daemon's password-authentication routine to harvest plaintext credentials. The confirmed initial access vector into the compromised South Korean media and automotive-sector infrastructure remains unconfirmed pending forensic evidence.

How DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' works

Rapid7 Labs published research on a previously undocumented DPRK-nexus toolset deployed against South Korean media and automotive organizations. The centerpiece is 'Ted,' a custom filter plugin compiled directly into an HAProxy 2.8.12 (build 0fdb194, released 2024-11-22) load-balancer binary. Ted hooks HAProxy's native HTTP-parser filter API to inspect and log high-value traffic, steal session cookies, and selectively inject malicious scripts into legitimate HTTP responses based on operator-controlled regex filters on URL, referer, and User-Agent, with payload selection tuned to client architecture via the Accept-Language header and response headers (Content-Type/Length/Disposition, Accept-Ranges) rewritten to mask the injection. Ted communicates with its operators over a chained XOR plus 67-character monoalphabetic substitution cipher, disguised as legitimate HTTP responses, and supports beaconing, file upload/download, and popen()-based command execution. It can also manipulate HAProxy's internal connection counters to scrub forensic evidence of the interception.

Ted operates alongside 'CurlRAT,' a family of trojanized replacements for legitimate Linux system daemons (crond/cronie, agetty, atd, sshd, polkitd) observed on CentOS 7.7/7.8/7.9 and Ubuntu 22.04 hosts. Each CurlRAT variant authenticates to C2 using a victim ID derived from the MD5 hash of a concatenated static string, hostname, IPv4 address, and hardware/OS UUID, communicates over a feedback-XOR-plus-Base64 scheme, and exposes six operator command modes covering shell command execution with output capture, configuration updates, staged payload delivery, reverse shell, system beaconing, and an interactive PTY shell. CurlRAT also monitors HAProxy's own health/PID status, tying the two toolset halves together, and defaults to a 12-hour beacon interval with an operator-triggerable 30-second fast-poll mode. A companion SSH keylogger hooks the userauth_passwd() routine inside the (also trojanized) sshd binary to intercept plaintext passwords from legitimate authentication attempts, writing them to an encrypted log at a hardcoded path under /var/lib/sshd/, while a hardcoded list of the threat actor's own master passwords is excluded from logging so operators do not capture their own credentials.

A separate stager component handles initial payload delivery: it fingerprints the target OS (hostname, distribution, kernel, CPU architecture) to select the correct pre-built binary, decrypts and swaps the target daemon binary in memory, then performs anti-forensic cleanup — selectively erasing lines containing keywords such as 'tmp', 'wget', 'cron', and 'crond' from /root/.bash_history and from /var/log/messages, audit/audit.log, cmd.log, secure, syslog, and auth.log, and timestomping the replaced crond binary to match the install timestamp of /usr/bin/ssh so the substitution does not stand out in a directory listing.

Rapid7 assesses medium-confidence attribution to a DPRK-nexus actor, with indicators favoring APT37: targeting of regional Groupware software, infrastructure mimicking Naver's pstatic.net static-content domain (a South Korean web platform), use of simple XOR and substitution ciphers, the watering-hole delivery model, and C2 infrastructure independently associated with APT37 by ThreatFox and maltrail. Rapid7 explicitly notes operational overlap with the concurrent Lazarus Group 'Operation SyncHole' campaign (November 2024-February 2025) against South Korean media, IT, semiconductor, and telecom firms, and cautions that APT37 and Lazarus are distinct DPRK state clusters operating under different agencies, so 'further evidence is necessary to make a more definitive assessment.' The confirmed initial-access vector into the affected media and automotive networks remains unconfirmed pending forensic evidence; Rapid7 flags exposed Groupware web portals and mail servers (observed ports 80, 443 for a Groupware login portal, and 25 for mail) as the most plausible entry point given that Kimsuky (a separate DPRK-nexus cluster) has been separately documented exploiting RCE vulnerabilities in externally accessible South Korean mail servers and Groupware vendor infrastructure in related, contemporaneous campaigns.

MITRE ATT&CK techniques used in TL-2026-2329

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.006 Timestomp; T1497.001 System Checks

Execution

T1059.004 Unix Shell; T1559 Inter-Process Communication

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding

Collection

T1074.001 Local Data Staging; T1557 Adversary-in-the-Middle

Discovery

T1082 System Information Discovery

Credential Access

T1539 Steal Web Session Cookie; T1556 Modify Authentication Process

Privilege Escalation

T1548.001 Setuid and Setgid

Persistence

T1554 Compromise Host Software Binary

defense-impairment

T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs

Affected products and versions in DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted'

  • HAProxy Technologies — HAProxy
    Vulnerable versions: 2.8.12 (build 0fdb194) recompiled by the threat actor with a malicious custom HTTP filter plugin — not an upstream HAProxy vulnerability
  • Multiple Linux distributions — System daemons (crond/cronie, agetty, atd, sshd, polkitd)
    Vulnerable versions: CentOS 7.7; CentOS 7.8; CentOS 7.9; Ubuntu 22.04

Remediation for DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted'

Immediate actions

  • Audit HAProxy and other internet-facing load balancer/edge binaries for unauthorized custom-compiled filters or plugins that do not match verified upstream vendor builds
  • Verify cryptographic checksums of crond/cronie, agetty, atd, sshd, and polkitd binaries against known-good vendor packages on all internet-facing and internal Linux hosts
  • Search proxy, firewall, and DNS logs for the C2 domains img.monderhouse.space, img.smartnords.site, img.darklights.store, img.responsive.pstatic.autos, img.socialteams.store, and img.worksongo.store, and block them at the perimeter
  • Inspect /var/lib/sshd/, /var/lib/snapd/, and /tmp for the specific artifact file paths and SHA-256 hashes identified in this report

Workarounds

  • Restrict direct internet exposure of Groupware/mail-server management portals until the initial-access vector for this campaign is confirmed
  • Rotate SSH and downstream application credentials on any Linux host found running a trojanized crond, sshd, agetty, atd, or polkitd binary

Longer-term hardening

  • Deploy file-integrity monitoring and behavioral EDR on internet-facing load balancers, reverse proxies, and Linux edge systems, since a compromised HAProxy/CurlRAT deployment can scrub its own forensic counters and logs
  • Implement network traffic correlation that is independent of the load balancer's own telemetry, so response-injection activity cannot be hidden by on-host log/counter manipulation
  • Harden and closely monitor externally exposed Groupware web portals and mail servers, given repeated DPRK-nexus actor targeting of this exposed application class in South Korea
  • Forward Linux audit, auth, and command-history logs to a centralized, tamper-resistant collector to defeat on-host selective log erasure

Timeline of DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted'

  • Lazarus Group's 'Operation SyncHole' begins targeting South Korean media, IT, semiconductor, and telecom firms via watering-hole attacks and Cross EX/Innorix Agent exploitation; Rapid7 notes operational overlap between this campaign's targeting patterns and SyncHole (campaign window: Nov 2024-Feb 2025).
  • HAProxy 2.8.12 (build 0fdb194) is released upstream; this exact build later becomes the codebase the threat actor recompiles with the malicious 'Ted' filter plugin.
  • Operation SyncHole activity window closes, per Kaspersky's Securelist reporting; overlap with the Ted/CurlRAT campaign is cited by Rapid7 as one of several factors in its medium-confidence DPRK attribution.
  • Earliest known Ted backdoor and CurlRAT samples are first uploaded to VirusTotal, indicating the toolset was already compiled and in circulation by mid-2025.
  • ENKI WhiteHat/The Record report a separate Kimsuky compromise of a South Korean groupware vendor via an RCE vulnerability in an externally accessible mail server (deploying Gomir/BirdTroy/DriveTroy malware) — cited by Rapid7 as precedent supporting its (unconfirmed) hypothesis for this campaign's initial-access vector.
  • ENKI WhiteHat publishes further analysis of Kimsuky's abuse of South Korean groupware/mail infrastructure, reinforcing the exposed-Groupware/mail-server initial-access hypothesis Rapid7 applies to this campaign.
  • Rapid7 publishes 'DPRK APTs: Ted Backdoor & CurlRAT Target South Korean Media, Automotive Sectors,' the first public disclosure of the Ted backdoor and CurlRAT toolset, attributing the campaign with medium confidence to a DPRK-nexus actor (suspected APT37, possibly Lazarus Group).

Sources cited for DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted'

More in malware

Detection coverage for TL-2026-2329

As of 2026-09-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2329 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats