Rapid7 Labs identified a previously undocumented Linux espionage framework built around an implant it calls the TED backdoor. Security researchers now refer to the broader framework as the TED Linux toolkit. Attackers compiled it directly into HAProxy load balancer software at South Korean media and automotive organizations.<\/p>\n
Rapid7 attributes the campaign to a North Korean APT with medium confidence. The assessment cites overlapping command-and-control<\/a> infrastructure with APT37, also known as ScarCruft or Ricochet Chollima.<\/p>\n This matters operationally because load balancers terminate SSL traffic before it reaches applications. A malicious module living inside that appliance can read decrypted traffic directly. It never needs a separate interception attack. Many organizations also exclude load balancers from endpoint detection coverage, treating them as network appliances rather than servers.<\/p>\n