[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fImxv2SwcXqCw6DS3tfkj_zVIsVGckT7FrTiiimVpuLs":3},{"article":4,"iocs":51,"watch_terms":62,"solutions":63,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"ad1f39af-5c1d-4efc-a638-abb8a6e8d2a0","North Korean Hackers Deploy New Linux Espionage Toolkit","north-korean-hackers-deploy-new-linux-espionage-toolkit-bbf12c","The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek.","North Korea-aligned threat actors are utilizing a new Linux toolkit for long-term surveillance, targeting automotive and media organizations in South Korea. The sophisticated framework includes a HAProxy backdoor named 'ted backdoor' and trojanized system utilities, enabling remote command execution, credential harvesting, and script injection. The toolkit's deep integration into the victim's infrastructure and its use of techniques similar to APT37 and Lazarus Group suggest a persistent and stealthy espionage campaign.","North Korean hackers deploy new Linux espionage toolkit targeting automotive and media firms in South Korea.","https:\u002F\u002Fwww.securityweek.com\u002Fnorth-korean-hackers-deploy-new-linux-espionage-toolkit\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F01\u002FNorth-Korea-hacking.jpeg","2026-09-07T12:12:08+00:00","2026-09-07T14:00:10.388156+00:00",8,[17,20,22,25],{"name":18,"type":19},"APT37","threat_actor",{"name":21,"type":19},"Lazarus Group",{"name":23,"type":24},"Operation SyncHole","campaign",{"name":26,"type":27},"HAProxy","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,55,58],{"type":45,"value":53,"context":54},"ted backdoor","HAProxy backdoor component",{"type":45,"value":56,"context":57},"CurlRAT","curl-based RAT deployed in attacks",{"type":59,"value":60,"context":61},"domain","pstatic.net","Mimicked domain for payload delivery",[26],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":95,"name":96,"problem":97,"products":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":50,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":175},"north-korean-apt-deploys-stealthy-linux-toolkit-targeting-south-korean-industries","North Korean APT Deploys Stealthy Linux Toolkit Targeting South Korean Industries","North Korea-aligned threat actors have deployed a sophisticated Linux espionage toolkit that trojanizes legitimate system utilities and embeds a HAProxy backdoor, making detection extremely difficult through conventional means. The root cause lies in poor configuration management — legitimate tools like HAProxy were tampered with and redeployed within victim environments without detection, indicating weak integrity verification and insufficient monitoring of system binaries. The deep integration of the toolkit into existing infrastructure suggests the attackers maintained persistent, undetected access over an extended period, highlighting critical gaps in both endpoint visibility and network segmentation. This matters because espionage campaigns of this nature can silently exfiltrate sensitive intellectual property, credentials, and strategic data over months or years before discovery.",[163,164,165,166,167,168,169,170,171,172,173,174],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SI-7 – Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SC-7 – Boundary Protection","MITRE ATT&CK T1543 – Create or Modify System Process","MITRE ATT&CK T1556 – Modify Authentication Process","MITRE ATT&CK T1070 – Indicator Removal on Host","ITIL – Event Management (Detect and Monitor Anomalies)","ISO\u002FIEC 27001 A.12.6 – Technical Vulnerability Management",{}]