# DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux Daemons Against South Korean Media and Automotive Sectors

> Rapid7 disclosed a DPRK-nexus intrusion set (medium confidence, suspected APT37, possibly Lazarus Group) using a custom HAProxy 2.8.12 filter plugin called 'Ted' to intercept HTTP traffic, steal session cookies, and deliver watering-hole payloads, alongside 'CurlRAT' — a family of trojanized Linux system daemons (crond, agetty, atd, sshd, polkitd) providing remote command execution and reverse-shell access — plus an SSH keylogger that hooks the daemon's password-authentication routine to harvest plaintext credentials. The confirmed initial access vector into the compromised South Korean media and automotive-sector infrastructure remains unconfirmed pending forensic evidence.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-16T10:48:25.687Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2329
- **ID:** TL-2026-2329
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Rapid7 Labs published research on a previously undocumented DPRK-nexus toolset deployed against South Korean media and automotive organizations. The centerpiece is 'Ted,' a custom filter plugin compiled directly into an HAProxy 2.8.12 (build 0fdb194, released 2024-11-22) load-balancer binary. Ted hooks HAProxy's native HTTP-parser filter API to inspect and log high-value traffic, steal session cookies, and selectively inject malicious scripts into legitimate HTTP responses based on operator-controlled regex filters on URL, referer, and User-Agent, with payload selection tuned to client architecture via the Accept-Language header and response headers (Content-Type/Length/Disposition, Accept-Ranges) rewritten to mask the injection. Ted communicates with its operators over a chained XOR plus 67-character monoalphabetic substitution cipher, disguised as legitimate HTTP responses, and supports beaconing, file upload/download, and popen()-based command execution. It can also manipulate HAProxy's internal connection counters to scrub forensic evidence of the interception.

Ted operates alongside 'CurlRAT,' a family of trojanized replacements for legitimate Linux system daemons (crond/cronie, agetty, atd, sshd, polkitd) observed on CentOS 7.7/7.8/7.9 and Ubuntu 22.04 hosts. Each CurlRAT variant authenticates to C2 using a victim ID derived from the MD5 hash of a concatenated static string, hostname, IPv4 address, and hardware/OS UUID, communicates over a feedback-XOR-plus-Base64 scheme, and exposes six operator command modes covering shell command execution with output capture, configuration updates, staged payload delivery, reverse shell, system beaconing, and an interactive PTY shell. CurlRAT also monitors HAProxy's own health/PID status, tying the two toolset halves together, and defaults to a 12-hour beacon interval with an operator-triggerable 30-second fast-poll mode. A companion SSH keylogger hooks the userauth_passwd() routine inside the (also trojanized) sshd binary to intercept plaintext passwords from legitimate authentication attempts, writing them to an encrypted log at a hardcoded path under /var/lib/sshd/, while a hardcoded list of the threat actor's own master passwords is excluded from logging so operators do not capture their own credentials.

A separate stager component handles initial payload delivery: it fingerprints the target OS (hostname, distribution, kernel, CPU architecture) to select the correct pre-built binary, decrypts and swaps the target daemon binary in memory, then performs anti-forensic cleanup — selectively erasing lines containing keywords such as 'tmp', 'wget', 'cron', and 'crond' from /root/.bash_history and from /var/log/messages, audit/audit.log, cmd.log, secure, syslog, and auth.log, and timestomping the replaced crond binary to match the install timestamp of /usr/bin/ssh so the substitution does not stand out in a directory listing.

Rapid7 assesses medium-confidence attribution to a DPRK-nexus actor, with indicators favoring APT37: targeting of regional Groupware software, infrastructure mimicking Naver's pstatic.net static-content domain (a South Korean web platform), use of simple XOR and substitution ciphers, the watering-hole delivery model, and C2 infrastructure independently associated with APT37 by ThreatFox and maltrail. Rapid7 explicitly notes operational overlap with the concurrent Lazarus Group 'Operation SyncHole' campaign (November 2024-February 2025) against South Korean media, IT, semiconductor, and telecom firms, and cautions that APT37 and Lazarus are distinct DPRK state clusters operating under different agencies, so 'further evidence is necessary to make a more definitive assessment.' The confirmed initial-access vector into the affected media and automotive networks remains unconfirmed pending forensic evidence; Rapid7 flags exposed Groupware web portals and mail servers (observed ports 80, 443 for a Groupware login portal, and 25 for mail) as the most plausible entry point given that Kimsuky (a separate DPRK-nexus cluster) has been separately documented exploiting RCE vulnerabilities in externally accessible South Korean mail servers and Groupware vendor infrastructure in related, contemporaneous campaigns.

## MITRE ATT&CK

- T1059.004 Unix Shell
- T1559 Inter-Process Communication
- T1554 Compromise Host Software Binary
- T1548.001 Setuid and Setgid
- T1036.005 Match Legitimate Resource Name or Location
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1070.006 Timestomp
- T1027 Obfuscated Files or Information
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1557 Adversary-in-the-Middle
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1190 Exploit Public-Facing Application
- T1106 Native API
- T1070.002 Indicator Removal
- T1480 Execution Guardrails
- T1556.003 Modify Authentication Process
- T1057 Process Discovery
- T1119 Automated Collection
- T1041 Exfiltration Over C2 Channel

## Sources

- [DPRK APTs: Ted Backdoor & CurlRAT Target South Korean Media, Automotive Sectors](https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors)
- [Operation SyncHole: Lazarus APT updates its toolset in watering hole attacks](https://securelist.com/operation-synchole-watering-hole-attacks-by-lazarus/116326/)
- [Lazarus Hits 6 South Korean Firms via Cross EX, Innorix Flaws](https://thehackernews.com/2025/04/lazarus-hits-6-south-korean-firms-via.html)
- [South Korean Companies Targeted by Lazarus via Watering Hole Attacks, Zero-Days](https://www.securityweek.com/south-korean-companies-targeted-by-lazarus-via-watering-hole-attacks-zero-days/)
- [New Kimsuky campaign compromised South Korean software vendors](https://therecord.media/kimsuky-north-korea-espionage-groupware-companies)
- [Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant](https://www.enki.co.kr/en/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant)
- [APT37, Ricochet Chollima, ScarCruft, Reaper, Group123 (G0067)](https://attack.mitre.org/groups/G0067/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2329