Dark ReadingRobert Lemos
North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers
Part of the APT37 story · since 1 Sep 2025
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers. This article, 19th of 19.
A likely North Korean advanced persistent threat group has targeted South Korean media and automotive organisations, with some compromises reportedly active since early 2025. Rapid7 attributed the activity to North Korean groups with medium confidence, citing the sectors targeted, simple obfuscation and command-and-control servers matching infrastructure associated with APT37, also known as InkySquid, ScarCruft and Ricochet Chollima.
Media victims could expose unpublished reporting and journalist communications, while automotive companies may provide access to manufacturing intellectual property and technology.
The attackers reportedly compromised HAProxy open-source load balancers after gaining access through edge web servers, groupware or email portals, although the precise initial access method is unknown. They installed a previously undocumented Linux implant called TED, which used the load balancer’s filter API to access decrypted communications when SSL terminated on the appliance.
Rapid7 said the toolkit supported credential theft, selective user redirection and drive-by downloads, while modifying or scrubbing logs to conceal activity. Its command-and-control responses reportedly bypassed HAProxy’s logging system, generating no anomalous processes or unexpected outbound connections.
Rapid7 advised organisations to inspect load balancers and other network appliances using library and compiled-binary integrity checks, process-memory audits, on-device and independent log comparisons, and network correlation. The researchers warned that any SSL-terminating load balancer or reverse proxy supporting runtime-loaded modules could present a similar attack surface and should receive monitoring comparable to application servers.
How the story developed
19 articles from 7 outlets since 1 Sep. Quiet since 16 Sep. This was the 19th report, 380 days after the first.
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers. This article, 19th of 19.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 19 articles as a listHide the list
- Mon 1 SepDay 02
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics08:45 · The Hacker News · First report
- North Korea’s APT37 deploys RokRAT in new phishing campaign against academics13:00 · Security Affairs
- Tue 2 SepDay 11
Quiet for 7 days
Tue 9 SepDay 81- APT37 Deploys New Rust and Python Malware Targeting Windows Systems07:05 · GBHackers · Picked up again
- Wed 10 SepDay 91
- APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer01:46 · SecurityOnline
Quiet for 9 weeks
Tue 11 NovDay 711- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline · Picked up again
Quiet for 6 weeks
Wed 24 DecDay 1141- “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets01:50 · SecurityOnline · Picked up again
Quiet for 9 weeks
Fri 27 FebDay 1792- ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets13:26 · The Hacker News · Picked up again
- APT37 hits airgapped networks via USB in Ruby Jumper campaign14:28 · Infosecurity
Quiet for 3 days
Mon 2 MarDay 1822- APT37 targets airgapped systems using five tools in Ruby Jumper12:10 · SecurityWeek · Picked up again
- APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C213:42 · Security Affairs
Quiet for 6 weeks
Mon 13 AprDay 2241- North Korea APT37 uses fake Facebook to spread RokRAT via PDF10:32 · The Hacker News · Picked up again
Quiet for 3 weeks
Tue 5 MayDay 2462- ScarCruft deploys Android BirdCall backdoor via sqgame.net10:00 · The Hacker News · Picked up again
- North Korean Hackers Trojanise Korean Gaming Site to Spy on Users15:21 · Infosecurity
Quiet for 6 weeks
Tue 16 JunDay 2881- North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT08:50 · The Hacker News · Picked up again
Quiet for 3 days
Fri 19 JunDay 2911- APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs08:50 · SecurityOnline · Picked up again
Quiet for 4 weeks
Fri 17 JulDay 3191- North Korean APT37 uses Dropbox phishing to deliver RokRAT malware14:11 · SecurityOnline · Picked up again
Quiet for 8 weeks
Thu 10 SepDay 3741- Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea09:54 · SecurityOnline · Picked up again
Quiet for 6 days
Wed 16 SepDay 3801- North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers01:24 · Dark Reading · Picked up again · This article, 19th of 19