North Korean Hackers Unveil New Linux Espionage Toolkit as Cybersecurity Threat

Post Views: 8

North Korea-aligned threat actors have been using a Linux-based espionage framework targeting South Korean automotive and media entities, according to Rapid7.

Report Overview

North Korea-aligned threat actors have been employing a novel Linux-based espionage framework in targeted attacks against automotive and media entities in South Korea, according to a report from Rapid7.

Framework Details

The toolkit, designed for sustained surveillance, incorporates a HAProxy instance known as the “ted backdoor” alongside compromised versions of system utilities including ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. This infrastructure enables remote command execution, credential theft, and injection of malicious scripts into web traffic, allowing attackers to maintain undetected access over extended periods.

ted Backdoor

The framework is deeply embedded within the victim’s environment, with the ted backdoor compiled as part of HAProxy version 2.8.12. It leverages HAProxy’s native filter API and internal memory pools to operate covertly.

Deployment Timeline

The toolkit’s deployment is believed to have begun in late 2024, coinciding with the release of the initial HAProxy iteration.

Components and Attack Chain

Additional components include a curl-based remote access trojan (RAT), an SSH keylogger, and a stager mechanism. Initial compromise was achieved through exploitation of a vulnerability in a Groupware login portal, providing access to an edge server.

SSH Keylogger

The SSH keylogger, which also functions as a staging server, facilitates credential harvesting and lateral movement across internal networks.

Stager Mechanism

The stager identifies the presence of either ‘crond’ or HAProxy before deploying the CurlRAT, retrieving it from its data section or an edge web server.

ted Backdoor Installation

Simultaneously, the ted backdoor is installed on the HAProxy load balancer. This backdoor establishes command-and-control (C&C) communication for data exfiltration, script injection, and remote execution, while the load balancer redirects or serves malicious content to specific clients.

CurlRAT Operation

The CurlRAT operates by polling the C&C server every 12 hours for instructions. It decrypts and executes commands stored in its configuration, decodes and writes a new configuration payload to disk, and deploys an interactive PTY shell.

ted Backdoor Integration

The ted backdoor, a custom HAProxy plugin integrated into the HAProxy source code, hooks into the balancer’s HTTP parser to intercept and inject HTTP traffic, ensuring persistence and enabling additional attack capabilities.

Domains and Techniques

Attackers utilized domains linked to the ted backdoor and CurlRAT, which were engineered for long-term espionage. These tools can steal session cookies, credentials, and redirect users to malicious content.

Analysis and Attribution

Analysis of recovered artifacts and infrastructure suggests the use of watering-hole techniques previously associated with APT37 and Lazarus. The campaign’s timeline aligns with Operation SyncHole, a previously attributed Lazarus activity, indicating potential North Korean involvement.

Technical Details

Technical details include the deployment of malicious payloads through compromised system utilities, the use of HAProxy as a delivery vector, and the integration of multiple layers of persistence mechanisms. The attack chain highlights sophisticated techniques for maintaining access, evading detection, and exfiltrating sensitive data from targeted organizations.

Conclusion

The attack chain highlights sophisticated techniques for maintaining access, evading detection, and exfiltrating sensitive data from targeted organizations.