DPRK APTs Ted Backdoor and curlRAT Target South Korean Media...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
• Blog Title: DPRK APTs: Ted Backdoor and curlRAT Target South Korean Media and Automotive Sectors
• Suggested Section: Linux Hardening > Post-Exploitation, with a dedicated page for trojanized system daemons and SSH credential interception; cross-reference from Network Services Pentesting > Pentesting Web under HAProxy/reverse-proxy backdooring and selective response injection

🎯 Content Summary

Overview

Rapid7 Labs documents a previously unknown Linux espionage framework used against South Korean automotive and media organizations. The toolkit combines a malicious HAProxy 2.8.12 build named ted backdoor, the libcurl-based curlRAT, deployment stagers, an SSH password logger, and trojanized crond, agetty, atd, and polkitd daemons. Its capabilities include root-level command execution, file upload and...

🔧 Technical Details

Trojanizing trusted root daemons: A post-compromise implant can be compiled into or inserted alongside a legitimate daemon such as crond, agetty, atd, polkitd, or HAProxy. A root stager fingerprints the distribution, version, kernel, and architecture, decrypts a compatible replacement in memory, overwrites the original daemon, restarts its service, and copies timestamps from a trusted executable. This gives the malware the daemon's expected process name, privileges, startup behavior, and operational cover. Detect it with package verification, binary diffs, build-ID checks, and filesystem metadata analysis rather than process-name allowlists.

Capturing passwords inside the SSH authentication path: Modifying userauth_passwd() captures credentials at the point where the SSH server handles plaintext passwords. The implant can exempt attacker master passwords, encrypt all other credentials, and save...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added dedicated page:
  • src/linux-hardening/post-exploitation/linux-post-exploitation/trojanized-system-daemons-and-reverse-proxies.md
• Documented:
  • In-place daemon trojanization
  • SSH authentication-path password interception
  • HAProxy-native C2 and selective response injection
  • Proxy telemetry suppression
  • Timestomping and selective log rewriting
  • Technical triage and hunting commands
• Added navigation links from:
  • Linux Post-Exploitation
  • Pentesting Web methodology
  • src/SUMMARY.md
• Added the Rapid7 primary-source reference with linked citations.

Validation

• Verified internal links and {{#ref}} targets.
• Verified required page banners and reference placement.
• Verified balanced Markdown fences/details.
• git diff --check passed.
• No forbidden sources were introduced.
• Full mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 999
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening > Post-Exploitation, with a dedicated page for trojanized system daemons and SSH credential interception; cross-reference from Network Services Pentesting > Pentesting Web under HAProxy/reverse-proxy backdooring and selective response injection".

Repository Maintenance:

• MD Files Formatting: 999 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0