North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South Korea, Rapid7 reports.
Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’.
The toolkit supports remote command execution, credential harvesting, and script injection into web traffic, enabling attackers to spy on victims for long periods of time without detection.
According to Rapid7, the framework is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment.
“It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected,” the cybersecurity firm explains.
Likely in use since late 2024, when the first involved HAProxy iteration was released, the toolkit also uses a curl-based RAT, an SSH keylogger, and a stager.
Initial access to an edge server was obtained through the exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems.