Threat Actor 🇰🇵 North Korea

APT37

Also known as: APT 37 · Group 123 · Group123 · InkySquid · Operation Daybreak · Operation Erebus · Reaper Group · Reaper · Red Eyes · Ricochet Chollima · ScarCruft · Venus 121 · ATK4 · G0067 · Moldy Pisces · APT-C-28

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

Indicators of Compromise 12

Domain img[.]darklights[.]store Domain img[.]monderhouse[.]space Domain img[.]responsive[.]pstatic[.]autos Domain img[.]smartnords[.]site Domain img[.]socialteams[.]store Domain img[.]worksongo[.]store Filename /tmp/jasper-log Filename /var/lib/snapd/g580 Filename /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 Filename ~/cache/haproxy-1000.cache SHA-256 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 SHA-256 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558

Source Articles

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux backdoor named 'ted' has been discovered embedded within trojanized HAProxy binaries deployed at two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, enables command-and-control (C2) communication by mimicking legitimate HTTP responses, and allows attackers to execute shell commands, upload/download files, and modify configurations. Rapid7 Labs attributes the activity with medium confidence to North Korean state-sponsored actors, potentially linked to APT37, Lazarus, and Kimsuky clusters, based on infrastructure overlaps and operational patterns. The backdoor evades logging by manipulating HAProxy's internal connection counters and uses trojanized system binaries such as crond, sshd, agetty, atd, and polkitd to maintain persistence and exfiltrate credentials.

hacker-news ·6h ago