Several South Korean automotive and media companies have been targeted by a stealth Linux toolkit tied to groups aligned with the DPRK. This new malware setup—deployed quietly since early 2025—relies on two main components dubbed “Ted Backdoor” and “CurlRAT,” which work together to infiltrate corporate networks via edge servers before spreading internally. Analysts have connected the techniques to North Korean persistent threat actors with medium confidence.
The Attack Chain: HAProxy Exploitation and Credential Theft
At the heart of the operation lies the Ted Backdoor, a modified version of HAProxy 2.8.12 that doubles as a load balancer. Rather than acting as a distinct malicious binary, it replaces or hijacks existing HAProxy components to inspect decrypted web requests. From this vantage point, it can harvest session cookies, intercept specific requests, inject malicious content into site responses for chosen visitors, and upload or download files. The implant also includes a hidden command channel masked as image-path requests and manipulates connection counters to evade detection. Additional compromised tools include standard Linux services—like crond, sshd, agetty, atd, and polkitd—that have been modified, and an SSH keylogger has also been discovered.
CurlRAT: The Remote-Control Backbone
CurlRAT complements Ted Backdoor with a remote-control layer. It periodically reaches out to attacker-controlled infrastructure, executes commands, reports system information, installs extra payloads, and provides reverse or interactive shells with elevated privileges. A watchdog process monitors the status of the compromised HAProxy, reporting on its start, stop, reload, or restart events. Configuration and communications are shielded behind basic XOR and substitution obfuscation, and the command-and-control domains mimic image-delivery services—including one styled to look like a well-known Korean web platform’s static content delivery structure.
Targets, Detection, and Defensive Measures
The initial access vector appears to be through groupware portals or mail servers on exposed ports—port 443 for groupware services and port 25 for mail functions. From there, adversaries leveraged edge servers with exposed ports 80, 443, and 25 as a staging ground to reach deeper into internal networks. Analysts warning of regional surveillance operations note that media and automotive firms in South Korea have long been strategic targets for intelligence gathering.
Potential indicators of compromise include modified Linux service binaries, unexpected shared libraries, altered cron jobs, and credentials that might have passed through exposed edge systems. Monitoring of outbound connections from load balancers, as well as web responses that differ for specific visitors, is advised. Regular patching of groupware and mail servers remains critical, as does verifying the integrity of HAProxy instances and other core services.
IoCs: Tools, Domains, Hashes
Several SHA-256 hashes linked to Ted Backdoor, CurlRAT stagers, Trojanized Linux binaries, and an SSH keylogger have been published. Among them are hashes for the modified HAProxy build, a variety of stager variants for CurlRAT, and several service daemons after exploit. Command-and-control domains have been identified, many using “img.” prefixes (e.g. img.monderhouse.space; img.responsive.pstatic.autos) to masquerade as image delivery platforms. These fake domains help the attackers blend into normal traffic.
Analysts recommend redeploying credentials potentially exposed, comparing service binaries with known good versions, and keeping a close eye on edge servers handling web, mail, or content delivery. Relying solely on local logs may be insufficient since adversaries have tampered with cron, log entries, and timestamps.
This operation fits a pattern of prolonged espionage rather than disruptive attacks—evidence supports intelligence collection, credential theft, session capture, and selective content alteration rather than overt sabotage. Use of long-running implants alongside the targeting of sectors of national interest suggest this toolkit is intended for staying power.
In what ways this threat matters: it underscores the danger of exposing edge services without strict segmentation. The fusion of Ted Backdoor and CurlRAT demonstrates how adversaries can weaponize trusted software like HAProxy to gain deep network access with minimal footprint. Industries with sensitive strategic exposure—like automotive and media—must rethink how they defend perimeter services.
