Stealthy attacks on South Korean automotive and media firms have given an espionage group access to victims’ networks — operating, in some cases, since early 2025.
In an analysis this week, Rapid7 attributed the attack to North Korean advanced persistent threat (APT) groups — although only with medium confidence — because of the targets of the attacks, the use of simple obfuscation, and a list of command-and-control (C2) servers that matches those used by APT37, also known as InkySquid, ScarCruft, and Ricochet Chollima. The focus on media companies could give the attackers access to source networks, unpublished reporting, and journalist communications, while automotive companies could be a gateway to manufacturing intellectual property and technology, according to Rapid7’s researchers, who asked not to be cited by name in an interview with Dark Reading.
“Together, the two sectors suggest at least two concurrent objectives: information control and counterintelligence from the media side, and manufacturing technology intelligence from the automotive side,” they note.
In the past, North Korean hackers have targeted financial firms, accounting for the lion’s share of cryptocurrency stolen in 2026. Other attacks have used deepfake military IDs to fool users and used traditional spear-phishing against South Korean embassy personnel.
In this case, the group behind the attacks compromised popular open source load balancer software, known as HAProxy, to install a hard-to-detect Linux toolkit (dubbed “TED”) and gain complete access to incoming and outgoing traffic, cybersecurity firm Rapid7 stated in its analysis of the group this week. Once resident in the victims’ network appliances, the cyber-threat group — thought to be North Korean — conducted long-term espionage operations, including harvesting credentials, redirecting select users, conducting drive-by-download attacks, and modifying log files to hide their tracks.
The compromise of a load balancer, followed by installing custom compiled code into the appliance’s software, is an iterative improvement for APT groups from North Korea, according to Rapid7’s research group.
The attack “fits a consistent Democratic People’s Republic of Korea (DPRK) pattern of initial access through trusted software or exposed infrastructure, long dwell times, credential harvesting, and watering-hole techniques targeting specific professional communities,” they say. “TED represents a further step by embedding into production infrastructure rather than running alongside it.”
Living Off the Load Balancer
HAProxy is an open source application load balancer and reverse proxy, which also forms the core of the enterprise offering HAProxy One. By compromising the load balancer, the attackers gain access to the appliance’s own filter API, letting them gain direct access to already decrypted plaintext communication, rather than having to create a host-in-the-middle attack. While the specific initial access point is not known, two victims — whose identities Rapid7 did not divulge — ran edge Web servers with groupware and email login portals accessible, according to the company’s analysis. Since the North Korean APT group Kimsuky is known to have compromised victims using remote exploits against email servers, those are likely initial-access points, Rapid7’s analysis stated.
Once a groupware server is compromised, the attackers used it as a launching point for the rest of their attacks while also harvesting credentials.
After compromising an edge Web server, attackers implant a load balancer with a backdoor, TED, to gain access to communications. Source: Rapid7
“From the attacker’s standpoint, the load balancer is an ideal location because SSL terminates there, it sits in front of all applications, and load balancers are often excluded from endpoint detection coverage because they are treated as network appliances rather than servers,” Rapid7’s research team says.
Technically, the most impressive bit of the attack is a routine that scrubs the counters in the log files to hide the attackers’ activity, showing that “someone spent serious time reading HAProxy source code and testing against a live instance,” the research team says.
The approach is only the latest example in a trend away from malware, with attackers instead burying malicious functionality inside legitimate software, the Rapid7 researchers say.
“Recent DPRK campaigns have progressed from using OS-native tools to avoid dropping binaries, to Trojanizing legitimate software installers, to embedding directly into the runtime of production infrastructure components,” they say. “TED represents that progression applied to a load balancer.”
Appliances Can be Cyber-Zombies Too
Chief information security officers (CISOs) in South Korea and the Asia-Pacific region should closely analyze their load balancers and other network appliances, Rapid7’s researchers warn. A variety of integrity checks against code libraries and compiled binaries should be combined with audits of process memory and a comparison between on-device and out-of-band logs.
Finding compromised devices is not an easy task.
“The implant generates no anomalous processes, no unexpected outbound connections and no log entries,” the researchers say. “Its C2 response path writes directly to the raw TCP socket and bypasses HAProxy’s logging subsystem, while the counter-scrubbing prevents monitoring dashboards from showing anomalous activity.”
Regional CISOs should closely consider similar weak points in their own architectures and consider that network appliance could be compromised, the researchers say.
“Any load balancer or reverse proxy that handles SSL termination and supports runtime-loaded modules represents the same attack surface regardless of vendor,” they say. “Organizations should apply the same endpoint detection discipline, including library integrity, memory baselining and independent network correlation, to infrastructure components that they already apply to application servers.”
