--- analysis: This is a hunt because it correlates the presence of a specific software version with behavioral network patterns and rare file system modifications by the proxy process. A single rule misses the context of the load balancer's persistent backdoor capabilities. blind_spots: - id: no-header-logging question: Whether the HTTP request carries the 'User-token' header used by CurlRAT remediation: Enable logging for the User-token header on edge proxies. requires: hb_http_activity with custom header logging risk: Legitimate traffic to the same infrastructure could trigger false positives without the unique header verification. stage: curl-rat-c2 - id: memory-filter-hooks question: Whether the Ted backdoor filter is hooked into the HAProxy memory pool remediation: Implement binary integrity monitoring for load balancer executables. requires: Kernel-level module monitoring or memory forensics risk: A trojanized HAProxy using internal APIs may not leave standard disk-based artifacts beyond the initial binary replacement. stage: ted-backdoor-interception coverage: - stage: curl-rat-c2 status: covered steps: - http-c2-traffic - outbound-socket-behavior - stage: ted-backdoor-interception status: covered steps: - scoping-haproxy-version - rare-haproxy-files - reason: 'Belongs to another part of the ''DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors'' series.' stage: initial-access-exploit status: out_of_scope - reason: 'Belongs to another part of the ''DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors'' series.' stage: credential-harvesting-sshd status: out_of_scope - reason: 'Belongs to another part of the ''DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors'' series.' stage: persistence-stager-binary-replacement status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: The Ted backdoor enables covert interception of all web traffic and session cookies handled by the load balancer. A negative result over the estate confirms this specific long-term espionage framework is not currently active. methodology: model-assisted trigger: intel-report hypothesis: An adversary has compromised the edge load balancer by installing a custom HAProxy filter and a Curl-based RAT to intercept web traffic and execute remote commands. labels: - hunt - attack.t1041 - attack.t1056.001 - attack.t1059.004 - attack.t1195.002 name: DPRK CurlRAT and HAProxy Ted Interception parameters: c2_domains: default: - img.darklights.store - img.monderhouse.space description: Domains used by CurlRAT for command and control. from: kind: article observed: '2026-09-04' ref: rapid7-dprk-apts-ted-backdoor type: list[domain] lookback_days: default: '14' description: The number of days to look back for activity. type: number scope_hosts: default: [] description: The hostnames identified in the scoping step; leave empty to hunt across the entire estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start the hunt on edge servers and load balancers. Focus on systems serving automotive or media-related groupware portals. references: - name: "Rapid7 \u2014 DPRK APTs: Ted backdoor and curlRAT target South Korean media\ \ and automotive sectors" url: https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors related: - hunt: sshd-keylogger-integrity reason: The SSH keylogger component requires specific integrity checks on sshd binaries and its encrypted log file, which is a separate host-integrity hunt. relation: out-of-scope-alternative - hunt: linux-system-daemon-trojanization-credential-harvesting relation: follows scenario: stages: - name: Exploitation of Edge Applications observables: - External ports 80, 443, 25 - Groupware login portal - Mail server access slug: initial-access-exploit tactic: initial-access techniques: - T1190 - name: Trojanized SSHD Keylogger observables: - Trojanized /usr/sbin/sshd - Encrypted log file /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 - Hardcoded master passwords in userauth_passwd() slug: credential-harvesting-sshd tactic: credential-access techniques: - T1056.001 - T1195.002 - name: Daemon Replacement via Stager observables: - Stager file /tmp/jasper-log - Replacement of /usr/sbin/crond - Timestomping crond to match /usr/bin/ssh creation date - Trojanized versions of agetty, atd, and polkitd - Filtering /root/.bash_history and /var/log/messages slug: persistence-stager-binary-replacement tactic: persistence techniques: - T1195.002 - T1059.004 - name: CurlRAT Command and Control observables: - HTTP POST to img.darklights.store - HTTP POST to img.monderhouse.space - User-token header containing MD5 victim ID - Directory /var/lib/snapd/ containing files g580, g105 - Configuration file /tmp/nimon.unix-docbase.8564479396043450766-db6fb4443bc slug: curl-rat-c2 tactic: c2 techniques: - T1041 - T1059.004 - name: HAProxy Traffic Interception observables: - HAProxy version 2.8.12 - Custom HAProxy filter plugin 'ted backdoor' - File /usr/lib/libvirtlog.so.0 - Watchdog thread monitoring /var/run/haproxy.pid - Cookie stealing and script injection into web traffic slug: ted-backdoor-interception tactic: collection techniques: - T1195.002 - T1056.001 summary: DPRK-linked actors (likely Kimsuky or APT37) deployed a sophisticated Linux toolkit targeting South Korean media and automotive sectors for long-term espionage. The campaign features the 'TED backdoor,' a custom HAProxy filter for traffic interception and script injection, and 'CurlRAT,' which is embedded in trojanized system daemons like crond and sshd to facilitate credential harvesting and remote command execution. series: index: 2 slug: dprk-apts-ted-backdoor-and-curlrat-target-south-korean-media-and-automotive-sectors title: 'DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # DPRK CurlRAT and HAProxy Ted Interception This hunt identifies Linux systems running the specific HAProxy version targeted by the Ted backdoor framework and searches for associated command-and-control activity. It focuses on the South Korean media and automotive sector campaign, looking for rare file writes by the haproxy process and HTTP traffic to known malicious domains. The flow uses a funnel approach to scope the environment before corroborating network and host indicators. ## scoping-haproxy-version Identify Linux hosts running the specific load balancer version used as the base for the Ted backdoor plugin. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames running HAProxy 2.8.12. Absence of results reduces the probability of this specific toolkit being present. reads: - device_hostname - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-28' ~~~ SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) = 'haproxy' AND package_version = '2.8.12' ``` ## investigation-fanout parallel: - → http-c2-traffic - → outbound-socket-behavior - → rare-haproxy-files join: → agent-triage ## http-c2-traffic Detect communication with hardcoded CurlRAT domains associated with APT37. ```sqlite target=web role=detection-candidate params=(c2_domains=c2_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: HTTP requests to malicious domains from the scoped proxies. Silence only proves these specific domains were not used. reads: - device_hostname - url_hostname - url_path - src_endpoint_ip - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, url_hostname, url_path, src_endpoint_ip, time FROM hb_http_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## outbound-socket-behavior Identify HAProxy or its children initiating outbound connections to non-internal addresses. ```sqlite target=network role=enrichment params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Outbound connections from a load balancer process to the public internet, suggesting C2 or exfiltration. reads: - device_hostname - process_name - dst_endpoint_ip - dst_endpoint_port - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE LOWER(process_name) LIKE '%haproxy%' AND direction = 'outbound' AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rare-haproxy-files Identify rare file modifications by the haproxy process in system directories like /usr/lib or /var/lib. ```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Unique files in system libraries or variable directories touched by the proxy process on a small number of hosts. prevalence: by: device_hostname key: - path rare_below: 3 reads: - device_hostname - file_path - process_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT LOWER(file_path) AS path, device_hostname, process_name, COUNT(*) AS touches, MIN(time) AS first_seen FROM hb_file_activity WHERE LOWER(process_name) LIKE '%haproxy%' AND (LOWER(file_path) LIKE '/usr/lib/%' OR LOWER(file_path) LIKE '/var/lib/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING COUNT(DISTINCT device_hostname) <= 3 ``` ## agent-triage ```agent target=hunter cite: required context: - scoping-haproxy-version - http-c2-traffic - outbound-socket-behavior - rare-haproxy-files max_iterations: 5 objective: Determine if any host shows evidence of HAProxy version 2.8.12 alongside malicious network traffic or unusual file modifications by the proxy process. success_criteria: A verdict of malicious, suspicious, or benign for each host with cited data rows. tools: - endpoint - network - web ``` ## route-findings if~: "the agent-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → manual-forensics unavailable: → manual-forensics (blind_spot: no-header-logging) else: → close-out-report ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Preserve the HAProxy process memory and examine system library directories for unauthorized files. ``` → manual-forensics ## manual-forensics ```manual target=analyst Manually inspect the HAProxy configuration and binary symbols for custom filters. Use a 1-byte XOR (0x58) to decrypt any files found in /var/lib/snapd. Search for /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 to confirm credential harvesting. ``` → close-out-report ## close-out-report ```manual target=analyst Summarize the hosts examined, the software versions identified, and any confirmed indicators. Close the hunt. ``` → end