Threat Intel
North Korean APT Breaches South Korean Media and Auto Firms via New Linux Toolkit on HAProxy Load Balancers
A suspected North Korean APT deployed a previously undocumented Linux espionage toolkit, dubbed "TED," to compromise HAProxy load balancers in South Korean media and automotive companies. The attackers leveraged the compromised appliances to harvest credentials, redirect traffic, and execute drive‑by downloads, fitting the DPRK pattern of long‑term espionage via trusted software. Rapid7 links the activity to APT37 with medium confidence, highlighting the dual focus on information control and manufacturing IP.
A recent analysis by Rapid7 uncovered a sophisticated operation targeting South Korean media and automotive firms. The attackers, likely an APT group linked to North Korea, used a new Linux-based espionage toolkit—named TED—to infiltrate HAProxy load balancers, a common open‑source solution in many enterprises.
Attack Overview
- Initial compromise of HAProxy load balancers via vulnerable or exposed infrastructure.
- Installation of the TED toolkit directly into the appliance’s firmware, granting full control over inbound and outbound traffic.
- Long‑term persistence with credential harvesting, traffic redirection, drive‑by downloads, and log tampering.
Toolkit & Tactics
- TED is a Linux‑only, stealthy espionage framework that embeds itself into production infrastructure.
- Command‑and‑control servers match those previously used by APT37 (InkySquid, ScarCruft, Ricochet Chollima).
- Use of simple obfuscation and watering‑hole techniques aimed at professional communities.
Implications for Target Sectors
- Media companies risk exposure of unpublished reporting, source networks, and journalist communications.
- Automotive firms face potential theft of manufacturing technology and intellectual property.
- Both sectors could serve as gateways for broader geopolitical espionage efforts.
Recommendations
- Audit all load balancer deployments for known vulnerabilities and unauthorized modifications.
- Implement strict access controls and continuous monitoring for traffic anomalies on HAProxy appliances.
- Apply the latest security patches and consider moving critical workloads to hardened, hardened platforms.
- Maintain a robust incident response plan that includes rapid containment of compromised infrastructure.
"The use of a new, undocumented Linux toolkit shows the APT group’s evolving strategy to embed itself within core network components rather than running alongside them," notes a Rapid7 analyst.
Related articles
BambooToken Malware Exploits MQTT to Command Windows and Linux Systems
A stealthy, previously unknown malware family called BambooToken has been active since 2023 and now leverages the MQTT protocol for command‑and‑control. The framework infects Windows and Linux hosts via side‑loading signed USB‑token software or by masquerading as the Kingsoft Office suite, then subscribes to broker topics to receive instructions. Researchers uncovered dead code hinting at keylogging, clipboard theft, and media capture, while the latest Linux variant (v2.1) can spawn shells and move files. Roughly a dozen enterprises—mostly in Asia and South America—were hit, with mobile‑app ba
Read briefing
Copy‑On‑Write Chaos: Detecting the 2026 Linux Privilege Escalation Surge
In 2026 a wave of Linux privilege‑escalation CVEs exploded from a single copy‑on‑write bug, hitting kernel interfaces from networking to filesystems. RootPwn’s briefing explains how the same exploit pattern surfaces across diverse subsystems, how Elastic Defend and Auditd can surface the common escalation flow, and what rules to deploy to catch both the generic root‑gain pattern and the specific COW‑related techniques.
Read briefing
August 17th Threat Intel: From Colombian Ransomware to AI‑Driven Espionage and Critical Vulnerabilities
This week’s bulletin highlights a ransomware hit on Colombia’s Ministry of Justice that stalled drug‑monitoring services, a 19‑million‑person data breach at Poland’s MyDr platform, and a social‑engineering attack on Levi Strauss that stole internal data. A phishing incident at U.S. defense contractor IEH Corp exposed sensitive engineering files. Researchers exposed a China‑linked AI campaign that mapped Taiwanese government systems, a North Korea‑linked Kimsuky offline AI toolkit, and the replayability of encrypted reasoning blocks from major LLM APIs. Patch Tuesday saw Microsoft, Apple, Adobe
Read briefing
North Korean Hackers Hijack Fake Coding Interviews with SVG Steganography to Steal Developer Credentials
A new DPRK‑aligned campaign, dubbed REF9403, injects malware into SVG flag images hidden inside seemingly legitimate coding challenge repositories. Triggered when developers run the “coding test,” the payload drops a four‑stage chain—browser credential and crypto‑wallet theft, file exfiltration, a Socket.IO RAT, and clipboard hijacking—mirroring the OTTERCOOKIE family. The attack surfaced after a Slack community received a bogus job posting and was found to be undetected by all major AV vendors. The case underscores the ongoing threat to developers and the need to scrutinize even seemingly har
Read briefing