This espionage campaign involves a custom Linux toolkit that integrates a backdoor called 'ted backdoor' into HAProxy 2.8.12, allowing attackers to intercept and manipulate HTTP traffic while maintaining normal load balancing functions. The toolkit also deploys trojanized versions of common Linux utilities and a curl-based RAT (CurlRAT) that polls command and control servers every 12 hours for instructions. The attackers gained initial access by exploiting a vulnerability in a Groupware login portal, then used an SSH keylogger for credential harvesting and lateral movement. The backdoor and RAT enable long-term persistence, data exfiltration, session cookie theft, script injection, and selective malicious content delivery. The campaign uses domains registered under low-cost TLDs and blends malicious traffic with legitimate web traffic to avoid detection. Attribution points to North Korean APT groups, with overlaps to previous campaigns such as Operation SyncHole.

The toolkit enables attackers to conduct prolonged espionage operations by stealthily intercepting and manipulating network traffic on compromised HAProxy load balancers. It facilitates credential harvesting, remote command execution, data exfiltration, and selective delivery of malicious content to targeted users. The compromise of automotive and media organizations in South Korea could lead to significant intelligence gathering and operational disruption. The use of trojanized system tools and advanced evasion techniques increases the difficulty of detection and remediation.

The source does not provide specific patch or remediation guidance. Patch status is not yet confirmed — check vendor advisories and security updates for HAProxy and related infrastructure components. Organizations should investigate and remediate vulnerabilities in Groupware login portals and monitor HAProxy instances for unauthorized modifications or unusual behavior. Given the advanced stealth techniques, consider deploying network traffic analysis tools capable of detecting anomalous HTTP traffic and backdoor activity. Incident response should focus on credential harvesting detection and lateral movement prevention.