Cyber Op Targets South Korean Media & Automotive Sectors
A North Korean advanced persistent threat (APT) group is suspected of targeting South Korean media and automotive firms since early 2025, utilizing a previously undocumented Linux espionage toolkit called "TED." The attackers gained access through compromised load balancers, leveraging the appliance's SSL termination capabilities to bypass traditional security measures and conduct long-term espionage operations, including credential harvesting and log manipulation. This represents a shift in North Korean tactics, moving beyond malware to embedding malicious functionality directly into production infrastructure components. The group’s approach is particularly sophisticated, employing counter-scrubbing to hide their activity and bypassing logging systems.
A likely North Korean advanced persistent threat (APT) group has been targeting South Korean automotive and media companies since early 2025, utilizing a previously undocumented Linux espionage toolkit called "TED." In an analysis this week, Rapid7 attributed the attack to North Korean APT groups, with medium confidence, due to the targets’ alignment with known DPRK objectives – information control and counterintelligence for the media sector, and manufacturing technology intelligence for the automotive sector.
In the past, North Korean hackers have targeted financial firms, accounting for the lion's share of cryptocurrency stolen in 2026. Other attacks have used deepfake military IDs to fool users and used traditional spearphishing against South Korean embassy personnel.
This time, the group compromised popular open source load balancer software, known as HAProxy, to install TED and gain complete access to incoming and outgoing traffic. Once resident in the victims’ network appliances, the cyber-threat group — thought to be North Korean — conducted long-term espionage operations, including harvesting credentials, redirecting select users, conducting drive-by-download attacks, and modifying log files to hide their tracks. The approach is only the latest example in a trend away from malware, with attackers instead burying malicious functionality inside legitimate software, the Rapid7 researchers say.
The compromise of a load balancer, followed by installing custom compiled code into the appliance’s software, is an iterative improvement for APT groups from North Korea. "TED represents that progression applied to a load balancer."
Appliances Can be Cyber-Zombies Too CISOs in South Korea and the Asia-Pacific region should closely analyze their load balancers and other network appliances. A variety of integrity checks against code libraries and compiled binaries should be combined with audits of process memory and a comparison between on-device and out-of-band logs. Finding compromised devices is not an easy task. "The implant generates no anomalous processes, no unexpected outbound connections and no log entries. Its C2 response path writes directly to the raw TCP socket and bypasses HAProxy’s logging subsystem, while the counter-scrubbing prevents monitoring dashboards from showing anomalous activity."
Regional CISOs should closely consider similar weak points in their own architectures and consider that network appliance could be compromised, the researchers say. "Any load balancer or reverse proxy that handles SSL termination and supports runtime-loaded modules represents the same attack surface regardless of vendor. Organizations should apply the same endpoint detection discipline, including library integrity, memory baselining and independent network correlation, to infrastructure components that they already apply to application servers."