New Linux toolkit found in trojanized HAProxy targeting South Korean organizations

As reported by The Hacker News, a sophisticated Linux toolkit, dubbed "ted" by its creators, has been discovered embedded within trojanized HAProxy load balancers at two South Korean organizations. This toolkit is designed to intercept web traffic and selectively serve modified content to specific visitors, indicating a targeted and stealthy approach by the attackers, according to Rapid7.

The implant, identified by Rapid7 Labs with medium confidence as originating from North Korean state-sponsored actors, targets entities in South Korea's automotive and media sectors. The attackers gained access by executing code on the host and replacing the legitimate HAProxy binary, rather than exploiting a vulnerability. This method allows the toolkit to operate undetected, as command-and-control (C2) requests are erased from HAProxy's connection counters, leaving no trace in backend logs or load balancer statistics. The implant filters requests based on specific criteria, including User-Agent, URL, referrer patterns, and client IP addresses, before serving altered pages. It manipulates HTTP headers to conceal modifications.

Evidence suggests the attackers may have gained initial access through an exposed Groupware portal, a common Korean enterprise collaboration software. The toolkit also includes a trojanized SSH daemon for capturing passwords and a companion remote access trojan (RAT) named curlRAT. Rapid7 recommends network correlation, memory behavioral analysis, and binary integrity checks for detection.

Source: The Hacker News