The campaign targeted organizations in South Korea’s automotive and media sectors, using compromised edge servers to steal credentials, monitor victims, inject malicious content into web traffic, and maintain long-term access.
At the center of the operation is a modified HAProxy load balancer, named the “ted backdoor.” Rather than deploying a separate and easily detectable web shell, the attackers compiled the implant directly into HAProxy version 2.8.12.
This lets the malware use HAProxy’s native filtering system, memory pools, event scheduler, and process controls while the server continues handling legitimate traffic normally. Rapid7 assesses the activity may be linked to North Korean threat actors with medium confidence.
The targeting of South Korean organizations, use of simple XOR encryption and substitution ciphers, and command-and-control domains previously associated with APT37 support the assessment. However, the initial access method and a definitive attribution remain unconfirmed.
North Korean Webserver Backdoors
The ted backdoor can intercept decrypted HTTP traffic inside HAProxy before it reaches the backend server. It can inspect selected requests, capture session cookies and HTTP headers, and identify high-value targets based on IP addresses, URLs, referrers, and user-agent strings.
The malware also contains a hidden command channel triggered through a request for a fake image path: /favorite_list_2x_m500_ico.jpg.
When the attacker sends a specially crafted request, the compromised HAProxy instance can execute commands, upload files, download data, and update its configuration.
Importantly, these command requests do not reach the real backend application. The implant captures the request inside HAProxy, sends attacker commands through named pipes, and returns results as seemingly ordinary HTTP responses.
It also modifies connection counters and traffic statistics, making the malicious activity harder to identify through HAProxy logs alone.
The backdoor can also inject scripts into web pages delivered to carefully selected users. It checks multiple conditions before altering a response, including the visitor’s IP address, requested page, referrer, browser details, and language headers.
This enables a watering-hole-style attack in which only specific visitors receive malicious JavaScript or modified content.
The toolkit includes trojanized versions of legitimate Linux services, including crond, atd, agetty, polkitd, and sshd. An SSH keylogger captures plaintext passwords entered by users and stores them in an encrypted file under /var/lib/sshd/.
A stager installs the malicious crond component after checking the target’s hostname, operating system, kernel, CPU architecture, and running services.
It supports several CentOS 7 versions and Ubuntu 22.04. After replacing the legitimate daemon, it restarts the service and timestomps the malicious file to match /usr/bin/ssh, Rapid7 said.
Indicators of Compromise
| IOC Type | Indicator | Associated Component / Notes |
|---|---|---|
| SHA-256 | 5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91 | CurlRAT stager |
| SHA-256 | 09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe | CurlRAT stager varian |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
