ted and curlRAT: North Korean Linux Surveillance Toolkit Hiding Inside HAProxy

1. Basic Information

• Article Title: DPRK APTs deploy ted backdoor and curlRAT against South Korean sectors
• Source: Rapid7
• Publication Date: 2026-09-04
• Original URL: Rapid7
• Related Sources: SecurityWeek: North Korean Hackers Deploy New Linux Espionage Toolkit
• Related Malware / Threat Actors / CVEs / Products: ted, curlRAT, SSH keylogger, DPRK-aligned APT (medium confidence), HAProxy 2.8.12, OpenSSH, cron, Linux
• Severity: High

2. Summary

An attacker assessed with medium confidence to be DPRK-aligned logged SSH passwords and used the ted backdoor—embedded as an internal filter into HAProxy 2.8.12—alongside curlRAT to conceal the selective interception, exfiltration, and tampering of web traffic.

3. Attack Flow

1. The attacker compromises an internet-facing Linux server. The exact initial access vector remains unconfirmed; exploitation of a groupware portal is an assumption in the analysis diagram.
2. An SSH keylogger collects plaintext passwords from administrators and users.
3. A stager checks root privileges, the OS, and the environment, then replaces crond and other binaries, clears logs, and performs timestomping.
4. curlRAT achieves persistence under several legitimate-looking process names, providing a remote shell and additional payloads.
5. The attacker embeds ted inside HAProxy to intercept and replace only traffic matching specific IPs, URLs, Referrers, and User-Agents, while hiding activity from logs and counters.

4. Threat Actor Location and Execution Context

• The attacker operates with root or elevated privileges on an internet-facing Linux server. No specific vulnerability used for initial access has been confirmed.

5. Visibility: Victim and Administrator Perspectives

Victims

• Web services continue to operate normally, so users may not notice the compromise. Only targeted users may experience response tampering or watering-hole attacks.

Administrators

• Local HAProxy logs and counters are tampered with, meaning normal metrics cannot be trusted. Administrators must verify binary integrity, memory, independent network logs, and disguised processes.

6. Conditions for Success and Failure

Conditions for Success

• The attacker obtains root-equivalent execution rights on the Linux server.
• The attacker can replace binaries and services such as HAProxy, SSH, and cron.
• Outbound communication to external C2 succeeds. While independent monitoring affects detection, it is not a prerequisite for successful compromise.

Conditions for Failure and Risk Reduction

• Comparing binary hashes, signatures, and package metadata of HAProxy, OpenSSH, cron, and related binaries against known-good baselines.
• Correlating logs that the compromised host cannot modify, such as network TAPs, upstream proxies, and load balancers.
• Rebuilding suspected compromised servers after preserving memory and disk, followed by rotating SSH keys, passwords, and certificates.

7. Impact of Successful Attack

• Theft of SSH passwords, cookies, sessions, and web traffic.
• Response injection, response replacement, and watering-hole attacks against targeted users.
• Reduction of HAProxy counters and suppression of specific C2 requests from reaching backend servers, preventing them from appearing in records.
• Long-term remote shells, additional payload delivery, and internal reconnaissance.

8. Observable Logs

Inference: The following records and scopes are relevant during an investigation:

• Email: Not used for direct verification in this incident.
• Proxy/SWG/DNS: Check upstream HTTP traffic for requests to /favorite_list_2x_m500_ico.jpg. Records from the compromised HAProxy and backend servers alone may fail to capture these requests.
• Endpoint/EDR: Inspect /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, replacements of crond and other binaries, file timestomping, and compare HAProxy binaries and memory against known baselines. Do not rely solely on file names.
• Identity/IdP: Check SSH authentication records for affected accounts, source IPs, and timestamps. Account for possible tampering of authentication logs on the compromised host.
• SaaS/Cloud: Not used for direct verification in this incident.
• Network: Monitor outbound HTTPS and HTTP traffic and their intervals. Use curlRAT's default 12-hour interval and 30-second fast mode as clues, but do not judge traffic as malicious solely based on matching intervals.

9. Determining Attack Success

Inference: The following criteria are for internal organizational assessments. They do not mean all damage stages were reported in this case.

• Attack Attempt Observed (Success Unconfirmed): Suspicious traffic or initial access traces detected against public-facing servers.
• Initial Execution Confirmed: Execution of a modified crond, stager, or SSH keylogger confirmed.
• Malware Execution or Successful Authentication Confirmed: C2 responses and remote shell activity from curlRAT or ted confirmed.
• Data Theft or Session Compromise Confirmed: Storage or exfiltration of plaintext passwords, cookies, or web traffic confirmed.
• Follow-on Activity Confirmed: Response injection, internal reconnaissance, or additional host compromises confirmed.

10. Investigation Playbook

Inference: Investigation guidance based on conditions established in public reporting.

• Trigger: Presence of /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, crond overwrites, timestomping on /usr/bin/ssh, or masqueraded service names.
• Initial Assessment: Identify affected versions, configurations, and public exposure, and preserve logs and configurations with reliable timestamps.
• Host: Inspect binaries, memory, service definitions, file timestamps, and password log files for HAProxy, OpenSSH, and cron.
• Authentication & Cloud: Identify credentials used over SSH and any systems sharing those credentials.
• Follow-on Activity: Track outbound communications, data collection, persistence, privilege escalation, and lateral movement.
• Containment: Compare binary hashes, signatures, and package metadata for HAProxy, OpenSSH, cron, and other tools against known-good baselines. Correlate logs from network TAPs, upstream proxies, and load balancers that cannot be altered from the compromised host. Rebuild suspected servers after preserving memory and disk, and rotate SSH keys, passwords, and certificates.
• Assessment Categories: Separate modified binary placement, execution, password logging, and external exfiltration. Treat the initial access vector as unconfirmed.

11. Defense and Detection Ideas

Inference: Operational proposals for defense and detection.

• Single Event: Detection of /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, crond overwrites, timestomping on /usr/bin/ssh, or disguised service names.
• Time-Series Correlation: Correlate service replacements and restarts, suspicious requests observed upstream of HAProxy, and outbound communications. Do not assume traffic is benign simply because backend logs show no records.
• Hunting: Combine searches for HAProxy, SSH, and cron binaries that deviate from official packages, password log files, and long-interval communications.
• Log Gaps: C2 requests consumed internally by HAProxy do not reach the backend. Compare with upstream traffic observations that cannot be modified from the compromised host.
• Priority Mitigations: Compare binary hashes, signatures, and package metadata for HAProxy, OpenSSH, cron, and related binaries against known-good baselines. Correlate logs from network TAPs, upstream proxies, and load balancers that cannot be modified from the compromised host. Rebuild suspected servers after preserving memory and disk, and rotate SSH keys, passwords, and certificates.

12. Facts / Inference / Hypothesis

Facts

• Rapid7 analyzed a previously unreported Linux compromise framework targeting the South Korean automotive and media sectors, attributing it with medium confidence to DPRK-aligned actors.
• The SSH keylogger intercepts plaintext passwords via userauth_passwd, applies character substitution and Base64 obfuscation, and writes them to /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19.
• ted is embedded into HAProxy 2.8.12's native filter API, internal memory pools, and scheduler, performing selective interception and injection while maintaining legitimate traffic.
• ted conceals C2 traffic within requests to /favorite_list_2x_m500_ico.jpg, decrements HAProxy counters, and hides its activity by not forwarding those requests to backend servers. This does not mean it deletes existing backend logs.
• curlRAT falls back from HTTPS to HTTP and supports command execution, configuration updates, payload drops, reverse shells, PTY (pseudoterminal) shells, and beacons. The stager overwrites crond, selectively deletes logs, and performs timestomping.

Inference

• When backdoors are embedded inside applications, normal service responses and the absence of local logs alone cannot confirm security. External traffic monitoring and binary integrity checks must be combined.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Gaps and Further Investigation."

13. MITRE ATT&CK Mapping

Inference: Mappings based on public reporting.

• T1556 Modify Authentication Process (High): Modifying the SSH authentication process to capture plaintext passwords.
• T1070.006 Indicator Removal: Timestomp (High): Matching file timestamps to legitimate binaries.

14. Gaps and Further Investigation

• The exact initial access vector, exploited vulnerabilities, and breach timeline.
• The total number of victim organizations and the specific data exfiltrated.
• Additional evidence required to raise attribution confidence.

15. Impact on SOCs and Organizations

HAProxy and Linux-based authentication and proxy infrastructures represent critical management surfaces for organizations globally. Even if local logs appear clean, teams must verify that independent observations across binaries, memory, and network telemetry align. In particular, monitor for discrepancies between requests and responses upstream and downstream of HAProxy, counter values, and backend logs, as well as long-interval beacons masquerading as legitimate service names. Maintain a clear separation between technical containment actions and the medium-confidence attribution.

16. Audience Summaries

• For SOC Analysts: Compare requests arriving upstream of HAProxy with backend records, and inspect systems for modified binaries and SSH password logs. Keep the medium-confidence DPRK attribution separate from the technical assessment of the unconfirmed initial access vector.
• For Administrators: Compare binary hashes, signatures, and package metadata for HAProxy, OpenSSH, cron, and related binaries against known-good baselines. Correlate logs from network TAPs, upstream proxies, load balancers, and other sources that cannot be altered from the compromised host.
• For Users: Web services continue to operate normally, so users may not notice the compromise. Only targeted users may experience response tampering or watering-hole attacks.