North Korean Hackers Unveil New Linux Espionage Toolkit as Cybersecurity Threat
North Korea-aligned threat actors have been using a Linux-based espionage framework targeting South Korean automotive and media entities, according to Rapid7.
Report Overview
North Korea-aligned threat actors have been employing a novel Linux-based espionage framework in targeted attacks against automotive and media entities in South Korea, according to a report from Rapid7.
Framework Details
The toolkit, designed for sustained surveillance, incorporates a HAProxy instance known as the “ted backdoor” alongside compromised versions of system utilities including ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. This infrastructure enables remote command execution, credential theft, and injection of malicious scripts into web traffic, allowing attackers to maintain undetected access over extended periods.
ted Backdoor
The framework is deeply embedded within the victim’s environment, with the ted backdoor compiled as part of HAProxy version 2.8.12. It leverages HAProxy’s native filter API and internal memory pools to operate covertly.
Deployment Timeline
The toolkit’s deployment is believed to have begun in late 2024, coinciding with the release of the initial HAProxy iteration.
Components and Attack Chain
Additional components include a curl-based remote access trojan (RAT), an SSH keylogger, and a stager mechanism. Initial compromise was achieved through exploitation of a vulnerability in a Groupware login portal, providing access to an edge server.
SSH Keylogger
The SSH keylogger, which also functions as a staging server, facilitates credential harvesting and lateral movement across internal networks.
Stager Mechanism
The stager identifies the presence of either ‘crond’ or HAProxy before deploying the CurlRAT, retrieving it from its data section or an edge web server.
ted Backdoor Installation
Simultaneously, the ted backdoor is installed on the HAProxy load balancer. This backdoor establishes command-and-control (C&C) communication for data exfiltration, script injection, and remote execution, while the load balancer redirects or serves malicious content to specific clients.
CurlRAT Operation
The CurlRAT operates by polling the C&C server every 12 hours for instructions. It decrypts and executes commands stored in its configuration, decodes and writes a new configuration payload to disk, and deploys an interactive PTY shell.
ted Backdoor Integration
The ted backdoor, a custom HAProxy plugin integrated into the HAProxy source code, hooks into the balancer’s HTTP parser to intercept and inject HTTP traffic, ensuring persistence and enabling additional attack capabilities.
Domains and Techniques
Attackers utilized domains linked to the ted backdoor and CurlRAT, which were engineered for long-term espionage. These tools can steal session cookies, credentials, and redirect users to malicious content.
Analysis and Attribution
Analysis of recovered artifacts and infrastructure suggests the use of watering-hole techniques previously associated with APT37 and Lazarus. The campaign’s timeline aligns with Operation SyncHole, a previously attributed Lazarus activity, indicating potential North Korean involvement.
Technical Details
Technical details include the deployment of malicious payloads through compromised system utilities, the use of HAProxy as a delivery vector, and the integration of multiple layers of persistence mechanisms. The attack chain highlights sophisticated techniques for maintaining access, evading detection, and exfiltrating sensitive data from targeted organizations.
Conclusion
The attack chain highlights sophisticated techniques for maintaining access, evading detection, and exfiltrating sensitive data from targeted organizations.
About Author
English