Suspected North Korean hackers may have spied on South Korean organizations for years using trojanized Linux system services and an HAProxy backdoor. Rapid7 researchers discovered a previously unknown set of malicious tools. These tools infected networks within the South Korean automotive and media sectors. Furthermore, the attackers replaced legitimate files like crond, sshd, polkitd, agetty, and atd. Consequently, these malicious processes looked like standard Linux components.

At a glance Actor or group Suspected DPRK APTs (APT37 links, medium confidence) Activity type Linux backdoor, watering-hole injection, credential theft Targets or victims South Korean media and automotive organizations Scale Two confirmed victims; likely long-term espionage Jurisdiction or status No arrests or indictments reported Source Rapid7 Labs; Kaspersky; Mandiant TL;DR Rapid7 Labs found a stealthy Linux toolkit named the ted backdoor.