Ted Backdoor and CurlRAT Targeting South Korean Sectors

A sophisticated Linux-based toolkit attributed to North Korean threat actors (Kimsuky, APT37, and Lazarus Group) has been identified targeting South Korean automotive and media industries. The campaign, active from late 2024 through 2026, utilizes a novel 'Ted' backdoor that integrates directly into victim HAProxy load balancers to intercept web traffic, harvest credentials, and inject malicious scripts. This toolkit represents a highly integrated approach to environment-specific persistence and surveillance.

The attack chain involves initial access likely through Groupware portal vulnerabilities or spear-phishing, followed by the deployment of trojanized system binaries (crond, sshd, agetty) and the CurlRAT framework. The malware employs multiple persistence mechanisms, including custom systemd services and cron jobs, while using advanced evasion techniques like atomical scrubbing of HAProxy connection counters and selective log erasure to hide its presence. Business impact is significant, focused on long-term data exfiltration and the compromise of downstream customers through vendor infrastructure.