Adversary Intelligence — 2026-09-05

DPRK APT37 Deploys Previously Undocumented Linux Espionage Toolkit Against South Korean Media and Automotive Sectors

BLUFCompiling implants directly into load-balancer binaries gives DPRK operators a persistence mechanism that most Linux endpoint and file-integrity tools will not detect, broadening the threat to any South Korean organization running exposed edge infrastructure.

Rapid7 Labs identified a previously undocumented Linux toolkit, compiled directly into victims' HAProxy 2.8.12 load balancers, targeting two South Korean media and automotive-sector organizations since at least early 2025 1. The implant, dubbed "ted" in the binary's debug strings, hooks HAProxy's native filter API to intercept web traffic, steal session cookies, and inject scripts into pages served to selected visitors, while trojanized versions of crond, agetty, atd, sshd, and polkitd provide an SSH keylogger, a curl-based RAT ("curlRAT"), and a stager for lateral movement 1. The Hacker News, corroborating Rapid7's findings, noted the toolkit is not a HAProxy vulnerability and requires prior code execution on the host to install 2. Rapid7 attributes the ted/curlRAT toolkit itself to APT37 with medium confidence via C2 domains linked by ThreatFox and Maltrail, but separately flags a concurrent Lazarus watering-hole campaign (Operation SyncHole) hitting the same South Korean media sites and identifies Kimsuky-style mail-server/Groupware-portal exploitation, per July 2026 ENKI WhiteHat research, as the likely initial access vector 1.

Analysis
Recompiling HAProxy itself to host the implant, rather than dropping a standalone backdoor, marks a meaningful escalation in DPRK Linux tradecraft, embedding persistence inside infrastructure that evades file-integrity and process monitoring, and a related nginx variant sharing the same codebase suggests a modular framework built for reuse across edge infrastructure beyond the two confirmed victims. The initial-access vector remains unresolved, plausibly exposed Groupware or mail-server portals consistent with Kimsuky's 2026 exploitation pattern, leaving other South Korean organizations running similar exposed applications unable to gauge their own exposure. Attribution to APT37 rests on hardcoded C2 infrastructure, a spoofable indicator that doesn't itself establish operational control, and sourcing rests on a single Rapid7 technical report merely amplified by other outlets. The two known victims may represent only the visible fraction of a broader campaign against South Korean edge infrastructure rather than a bounded operation.

3 sources