Rapid7 uncovers DPRK-linked Linux toolkit targeting South Korean sectors

Rapid7 Labs has identified a previously undocumented Linux toolkit used in campaigns against South Korean automotive and media organisations. The toolkit includes a backdoor embedded in HAProxy, named ted backdoor, alongside trojanised versions of system binaries and a curl-based RAT.

The malware is attributed with medium confidence to North Korean state-sponsored actors, with infrastructure and tradecraft consistent with APT37. The campaign is believed to have been active since early 2025, focusing on long-term espionage and credential theft.