ted and curlRAT: North Korean Linux Surveillance Toolkit Hiding Inside HAProxy
ted and curlRAT: North Korean Linux Surveillance Toolkit Hiding Inside HAProxy
ted 与 curlRAT：隐藏在 HAProxy 中的朝鲜 Linux 监控工具包
1. Basic Information
1. 基本信息
Article Title: DPRK APTs deploy ted backdoor and curlRAT against South Korean sectors 文章标题： 朝鲜 APT 组织针对韩国部门部署 ted 后门与 curlRAT
Source: Rapid7 来源： Rapid7
Publication Date: 2026-09-04 发布日期： 2026-09-04
Related Malware / Threat Actors / CVEs / Products: ted, curlRAT, SSH keylogger, DPRK-aligned APT (medium confidence), HAProxy 2.8.12, OpenSSH, cron, Linux 相关恶意软件/威胁行为者/CVE/产品： ted、curlRAT、SSH 键盘记录器、朝鲜背景 APT（中等置信度）、HAProxy 2.8.12、OpenSSH、cron、Linux
2. Summary
2. 摘要
An attacker assessed with medium confidence to be DPRK-aligned logged SSH passwords and used the ted backdoor—embedded as an internal filter into HAProxy 2.8.12—alongside curlRAT to conceal the selective interception, exfiltration, and tampering of web traffic. 据中等置信度评估，攻击者为朝鲜背景。他们记录了 SSH 密码，并使用嵌入在 HAProxy 2.8.12 内部过滤器中的 ted 后门，配合 curlRAT 来掩盖对网络流量的选择性拦截、窃取和篡改行为。
3. Attack Flow
3. 攻击流程
The attacker compromises an internet-facing Linux server. The exact initial access vector remains unconfirmed; exploitation of a groupware portal is an assumption in the analysis diagram. An SSH keylogger collects plaintext passwords from administrators and users. A stager checks root privileges, the OS, and the environment, then replaces crond and other binaries, clears logs, and performs timestomping. curlRAT achieves persistence under several legitimate-looking process names, providing a remote shell and additional payloads. The attacker embeds ted inside HAProxy to intercept and replace only traffic matching specific IPs, URLs, Referrers, and User-Agents, while hiding activity from logs and counters. 攻击者入侵了一台面向互联网的 Linux 服务器。确切的初始访问向量尚不明确；分析图表中假设利用了群件门户网站。SSH 键盘记录器会收集管理员和用户的明文密码。Stager（分段加载器）会检查 root 权限、操作系统和环境，随后替换 crond 及其他二进制文件，清除日志并进行时间戳伪造（timestomping）。curlRAT 通过多个看似合法的进程名称实现持久化，提供远程 Shell 和额外的有效载荷。攻击者将 ted 嵌入 HAProxy 中，仅拦截并替换匹配特定 IP、URL、Referrer 和 User-Agent 的流量，同时在日志和计数器中隐藏其活动。
4. Threat Actor Location and Execution Context
4. 威胁行为者位置与执行环境
The attacker operates with root or elevated privileges on an internet-facing Linux server. No specific vulnerability used for initial access has been confirmed. 攻击者在面向互联网的 Linux 服务器上以 root 或更高权限运行。目前尚未确认用于初始访问的具体漏洞。
5. Visibility: Victim and Administrator Perspectives
5. 可见性：受害者与管理员视角
Victims: Web services continue to operate normally, so users may not notice the compromise. Only targeted users may experience response tampering or watering-hole attacks. 受害者： Web 服务继续正常运行，因此用户可能不会察觉到入侵。只有目标用户可能会经历响应篡改或水坑攻击。
Administrators: Local HAProxy logs and counters are tampered with, meaning normal metrics cannot be trusted. Administrators must verify binary integrity, memory, independent network logs, and disguised processes. 管理员： 本地 HAProxy 日志和计数器已被篡改，这意味着正常的指标不可信。管理员必须验证二进制文件完整性、内存、独立的网络日志以及伪装的进程。
6. Conditions for Success and Failure
6. 成功与失败条件
Conditions for Success: The attacker obtains root-equivalent execution rights on the Linux server. The attacker can replace binaries and services such as HAProxy, SSH, and cron. Outbound communication to external C2 succeeds. While independent monitoring affects detection, it is not a prerequisite for successful compromise. 成功条件： 攻击者在 Linux 服务器上获得等同于 root 的执行权限。攻击者能够替换 HAProxy、SSH 和 cron 等二进制文件和服务。与外部 C2 的出站通信成功。虽然独立监控会影响检测，但它并非成功入侵的先决条件。
Conditions for Failure and Risk Reduction: Comparing binary hashes, signatures, and package metadata of HAProxy, OpenSSH, cron, and related binaries against known-good baselines. Correlating logs that the compromised host cannot modify, such as network TAPs, upstream proxies, and load balancers. Rebuilding suspected compromised servers after preserving memory and disk, followed by rotating SSH keys, passwords, and certificates. 失败条件与风险降低： 将 HAProxy、OpenSSH、cron 及相关二进制文件的哈希值、签名和包元数据与已知良好的基准进行比对。关联受感染主机无法修改的日志，例如网络分流器（TAP）、上游代理和负载均衡器。在保留内存和磁盘镜像后重建疑似受感染的服务器，随后轮换 SSH 密钥、密码和证书。
7. Impact of Successful Attack
7. 攻击成功的影响
Theft of SSH passwords, cookies, sessions, and web traffic. Response injection, response replacement, and watering-hole attacks against targeted users. Reduction of HAProxy counters and suppression of specific C2 requests from reaching backend servers, preventing them from appearing in records. Long-term remote shells, additional payload delivery, and internal reconnaissance. 窃取 SSH 密码、Cookie、会话和网络流量。针对目标用户进行响应注入、响应替换和水坑攻击。减少 HAProxy 计数器并阻止特定的 C2 请求到达后端服务器，从而防止它们出现在记录中。实现长期的远程 Shell、额外的有效载荷投递以及内部侦察。
8. Observable Logs
8. 可观测日志
Proxy/SWG/DNS: Check upstream HTTP traffic for requests to /favorite_list_2x_m500_ico.jpg. Records from the compromised HAProxy and backend servers alone may fail to capture these requests.
代理/SWG/DNS： 检查上游 HTTP 流量中是否存在对 /favorite_list_2x_m500_ico.jpg 的请求。仅凭受感染的 HAProxy 和后端服务器的记录可能无法捕获这些请求。
Endpoint/EDR: Inspect /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, replacements of crond and other binaries, file timestomping, and compare HAProxy binaries and memory against known baselines. Do not rely solely on file names.
终端/EDR： 检查 /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19、crond 及其他二进制文件的替换情况、文件时间戳伪造，并将 HAProxy 二进制文件和内存与已知基准进行比对。不要仅依赖文件名。
Network: Monitor outbound HTTPS and HTTP traffic and their intervals. Use curlRAT’s default 12-hour interval and 30-second fast mode as clues, but do not judge traffic as malicious solely based on matching intervals. 网络： 监控出站 HTTPS 和 HTTP 流量及其间隔。将 curlRAT 默认的 12 小时间隔和 30 秒快速模式作为线索，但不要仅凭间隔匹配就判定流量为恶意。
9. Determining Attack Success
9. 判定攻击成功
- Attack Attempt Observed: Suspicious traffic or initial access traces detected.
- 观察到攻击尝试： 检测到可疑流量或初始访问痕迹。
- Initial Execution Confirmed: Execution of a modified crond, stager, or SSH keylogger confirmed.
- 确认初始执行： 确认执行了修改后的 crond、stager 或 SSH 键盘记录器。
- Malware Execution or Successful Authentication Confirmed: C2 responses and remote shell activity from curlRAT or ted confirmed.
- 确认恶意软件执行或成功认证： 确认来自 curlRAT 或 ted 的 C2 响应和远程 Shell 活动。
- Data Theft or Session Compromise Confirmed: Storage or exfiltration of plaintext passwords, cookies, or web traffic confirmed.
- 确认数据窃取或会话受损： 确认存储或窃取了明文密码、Cookie 或网络流量。
- Follow-on Activity Confirmed: Response injection, internal reconnaissance, or additional host compromises confirmed.
- 确认后续活动： 确认存在响应注入、内部侦察或额外的服务器入侵。
10. Investigation Playbook
10. 调查手册
Trigger: Presence of /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, crond overwrites, timestomping on /usr/bin/ssh, or masqueraded service names.
触发条件： 存在 /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19、crond 被覆盖、/usr/bin/ssh 的时间戳伪造或伪装的服务名称。
Initial Assessment: Identify affected versions, configurations, and public exposure, and preserve logs and configurations with reliable timestamps. 初步评估： 识别受影响的版本、配置和公共暴露面，并保存具有可靠时间戳的日志和配置。
Host: Inspect binaries, memory, service definitions, file timestamps, and password log files for HAProxy, OpenSSH, and cron. 主机： 检查 HAProxy、OpenSSH 和 cron 的二进制文件、内存、服务定义、文件时间戳和密码日志文件。
Containment: Compare binary hashes, signatures, and package metadata for HAProxy, OpenSSH, cron, and other tools against known-good baselines. 遏制： 将 HAProxy、OpenSSH、cron 及其他工具的二进制哈希、签名和包元数据与已知良好的基准进行比对。