# North Korean Hackers Deploy New Linux Espionage Toolkit

> North Korean state-sponsored hackers target automotive and media firms in South Korea using a custom Linux espionage toolkit.

- Published: 2026-09-07T19:31:00.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Lazarus Group, APT37, Linux, Espionage, Malware
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/north-korean-hackers-deploy-new-linux-espionage-toolkit/
- Canonical: https://runtimerebel.com/blog/north-korean-hackers-deploy-new-linux-espionage-toolkit

## Key points

- Immediate impact: North Korea-aligned threat actors are conducting long-term surveillance and credential harvesting against automotive and media organizations in South Korea.
- Affected systems: Linux edge servers, HAProxy version 2.8.12 instances, and systems running trojanized system binaries such as agetty, atd, and crond.
- Remediation: Audit Linux load balancers and system binaries for unauthorized modifications, and monitor edge servers for anomalous administrative portal access.

North Korea-aligned threat actors have deployed a sophisticated Linux espionage toolkit targeting automotive and media organizations in South Korea, according to research published by [SecurityWeek](https://www.securityweek.com/north-korean-hackers-deploy-new-linux-espionage-toolkit/). Active since late 2024, the campaign relies on deep infrastructure integration, utilizing custom backdoors and trojanized system components to maintain persistent surveillance without detection.

## Technical Analysis of the Linux Espionage Toolkit

The espionage framework relies on [initial access](/glossary#initial-access) obtained through the exploitation of an edge server Groupware login portal [vulnerability](/glossary#vulnerability). Once inside the environment, the operators deploy a multi-stage toolkit designed to blend seamlessly with legitimate system activity and web traffic.

### The 'Ted [Backdoor](/glossary#backdoor)' and HAProxy Integration

A primary component of the campaign is a custom HAProxy plugin dubbed the 'ted backdoor'. According to telemetry analyzed by Rapid7, this backdoor is compiled directly into HAProxy version 2.8.12 running on compromised environments. By leveraging native filter APIs, internal memory pools, and event schedulers, the backdoor intercepts traffic and hides malicious activity while standard load-balancing operations continue uninterrupted.

### Supporting [Malware](/glossary#malware) Components

Beyond the modified load balancer, the threat actors utilize several auxiliary tools to secure [persistence](/glossary#persistence) and facilitate [lateral movement](/glossary#lateral-movement):

*   **CurlRAT:** A curl-based remote access trojan that polls command and control infrastructure every 12 hours. It can decrypt configurations, write new payloads to disk, and deploy full interactive PTY shells.
*   **[SSH](/glossary#secure-shell-ssh) [Keylogger](/glossary#keylogger):** Used primarily for [credential harvesting](/glossary#credential-harvesting) on staging servers to enable lateral movement across internal networks.
*   **Trojanized Binaries:** Modified versions of legitimate system utilities including `agetty`, `atd`, `crond`, and `polkitd` to maintain access.

Artifacts and infrastructure overlap with techniques historically attributed to state-sponsored groups such as APT37 and Lazarus Group, aligning with the timeframe of Operation SyncHole observed last year.

## Mitigation and Detection Strategies

Defenders operating Linux environments in targeted sectors should prioritize rigorous integrity checks on critical infrastructure binaries and load balancer source code. Organizations must implement strict monitoring for unauthorized modifications to HAProxy source deployments and scrutinize outbound traffic destined for low-cost commodity TLDs. Security teams should also audit edge server login portals and enforce multi-factor authentication to disrupt initial access vectors.

**Related:** [Google Disrupts NetNut Malicious Residential Proxy Network](/blog/google-disrupts-netnut-malicious-residential-proxy-network), [SilkParasite Espionage Campaign Targets Central Asian Governments](/blog/silkparasite-espionage-campaign-targets-central-asian-governments)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/north-korean-hackers-deploy-new-linux-espionage-toolkit