DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The actors likely gained the first foothold by exploiting an exposed groupware portal or mail service (‘the threat actor begins by exploiting a vulnerability in the Groupware login portal’).
• [T1059.004] Unix Shell – Commands were executed through popen and shell-based handlers, including reverse shell and PTY shell functions (‘executes commands via popen’, ‘full interactive PTY shell’).
• [T1106] Native API – The toolkit used native process and HAProxy APIs for threaded execution and traffic handling (‘pthread_create’, ‘task_wakeup’, ‘native filter API’).
• [T1574.006] Hijack Execution Flow: Dynamic Linker Hijacking – The implant was compiled as part of HAProxy and loaded as a shared-library-style filter at process start (‘compiled as part of the victim’s existing HAProxy version’).
• [T1543] Create or Modify System Process – Legitimate services were overwritten in place and restarted, such as crond (‘decrypted the trojanized crond binary in memory, overwrites the system’s legitimate daemon, and restarts the service’).
• [T1548] Abuse Elevation Control Mechanism – The RAT and reverse shell attempted root-level execution using setuid/setreuid (‘calls setuid(0) and setreuid(0, 0)’).
• [T1036.005] Masquerade: Match Legitimate Name or Location – Malware binaries and functions were disguised as legitimate system components (‘crond, polkitd, agetty, atd’, ‘masquerade as atd_ routines’).
• [T1070.002] Clear Linux or Mac System Logs – The stager removed traces from shell and system logs (‘filtering out keywords such as tmp, wget cron and crond’).
• [T1070.006] Timestomp – The backdoored crond binary was timestamped to match /usr/bin/ssh (‘same creation timestamp of /usr/bin/ssh’).
• [T1562.006] Disable or Modify System Firewall – HAProxy connection counters and related telemetry were scrubbed to hide activity (‘beconn/feconn and the global actconn’).
• [T1027] Obfuscated Files or Information – Configs, payloads, and C2 traffic were protected with XOR, substitution ciphers, and Base64 (‘simple xor-based encryption’, ‘Base64 encoding’).
• [T1497.001] Virtualization/Sandbox Evasion – CurlRAT checked for virtualization artifacts before running (‘checks the presence of the file /usr/lib/libvirtlog.so.0’).
• [T1480] Execution Guardrails – The stager and RAT only proceeded under specific environmental conditions (‘only if HAProxy or cron are running’, ‘validates victim token before handler dispatch’).
• [T1556.003] Pluggable Authentication Modules – The SSH keylogger intercepted plaintext credentials from authentication flows (‘intercepts legitimate users’ plaintext passwords’).
• [T1539] Steal Web Session Cookie – The backdoor captured session-related web data such as cookies and headers (‘steal session cookies’, ‘capture engine intercepts HTTP sessions’).
• [T1082] System Information Discovery – The malware profiled hostname, distro, kernel, CPU, and UUID to select payloads (‘profiles the OS checking system hostname, OS distribution and version’).
• [T1057] Process Discovery – CurlRAT monitored HAProxy process status through /proc and PID files (‘reads the pid at /var/run/haproxy.pid and monitors the status’).
• [T1185] Browser Session Hijacking – The implant rewrote or appended response bodies to deliver malicious content (‘response body replaced or appended with decrypted payload script’).
• [T1119] Automated Collection – The capture logic automatically logged selected HTTP request data and metadata (‘selectively logs and victims are identified’).
• [T1071.001] Application Layer Protocol: Web Protocols – C2 traffic was tunneled over HTTP/HTTPS to blend with normal web traffic (‘polls C2 over HTTPS with libcurl fallback to HTTP’).
• [T1132.001] Data Encoding: Standard Encoding – Payloads and commands were encoded with Base64 and XOR before transmission (‘Base64+XOR encoding/decoding applied to the payload’).
• [T1102] Web Service – Backup infrastructure used image-like web domains for C2 and configuration retrieval (‘img.darklights.store’, ‘img.monderhouse.space’).
• [T1572] Protocol Tunneling – Interactive shell traffic was relayed through HAProxy pipes and raw sockets (‘tunnelled through HAProxy HTTP pipeline via named FIFOs’).
• [T1568] Dynamic Resolution – The victim ID was derived from system attributes and used in authenticated requests (‘concatenating… system hostname, ipv4 address, and hardware/OS UUID’).
• [T1041] Exfiltration Over C2 Channel – Stolen passwords, command output, and telemetry were sent back through the same C2 channel (‘sends the result back’, ‘credentials exfiltrated via CurlRAT C2’).
• [T1560] Archive Collected Data – The keylogger and RAT stored captured data in encrypted logs before exfiltration (‘saved them to an encrypted log file’).