Tia N.List

CTI · corroborated · 2026-09-08

DPRK-Linked Actors Deploy Novel Linux Espionage Toolkit Against South Korean HAProxy Servers

Full story & timeline

Actors

DPRK-aligned (APT37 overlap, medium confidence)

Malware / tools

ted backdoor (HAProxy implant)

Campaigns

DPRK HAProxy server espionage campaign

CVEs

—

Victim sectors

automotivemedia

Geography

South Korea

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: HAProxy Backdoor Trigger Path Request (DPRK ted implant)
id: f4e2a1b7-8c3d-4e5f-9a0b-6d7e8f1c2a3b
status: experimental
description: Detects HTTP requests to the hidden command-channel trigger path used by the DPRK-linked 'ted backdoor' implanted in HAProxy binaries. The path /favorite_list_2x_m500_ico.jpg activates the implant's full command set when contacted with a specially crafted request.
references:
  - https://gbhackers.com/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-korean-organizations/
author: Tia N. List
date: 2026-09-08
tags:
  - attack.t1100
  - attack.t1071
logsource:
  category: webserver
  product: haproxy
detection:
  selection_path:
    cs-uri-statement|contains: '/favorite_list_2x_m500_ico.jpg'
  selection_method:
    cs-method: 'GET'
  condition: selection_path and selection_method
falsepositives:
  - Unlikely in normal HAProxy operation; any match is highly suspicious
level: high

YARA-X raw

rule DPRK_HAProxy_Ted_Backdoor {
  meta:
    author = "Tia N. List"
    date = "2026-09-08"
    status = "experimental"
    description = "Detects the DPRK-linked 'ted backdoor' implanted in HAProxy binaries. The implant intercepts HTTP traffic, captures session cookies, and uses a hidden command channel triggered by a specific image path."
    reference = "https://gbhackers.com/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-korean-organizations/"
    falsepositives = "None expected in production HAProxy binaries"
  strings:
    $trigger = "/favorite_list_2x_m500_ico.jpg"
    $haproxy_ref = "HAProxy" ascii nocase
    $cli_header = "X-CLI-Token" ascii
    $cmd_channel = "/cli/check" ascii
  condition:
    uint32(0) == 0x464C457F and
    $trigger and
    $haproxy_ref and
    1 of ($cli_header, $cmd_channel)
}

References

Source on GitHub