The operators' priorities show up in the watchdog. Rapid7 says the curl-based RAT that ships with this toolkit keeps a thread whose job is to track HAProxy's health and report it back to operator infrastructure [9]. The load balancer is the asset, and the rest of the kit exists just to keep it running and reachable.
The chain, as far as Rapid7 reconstructed it, runs through the edge box. Both victims exposed ports 80, 443 and 25, with a Groupware login portal on 443 and a mail server on 25 [5]. After the foothold, credentials come off that host, including plaintext passwords lifted by an SSH keylogger [14], and the same host doubles as the staging server for the trojanized system ELFs [13]. A stager then goes to internal servers, checks whether crond or HAProxy is present, and only then deploys CurlRAT, pulling it from its own data section or back from the edge webserver [15]. In parallel ted lands on the load balancer and opens its own C2 channel for exfiltration, command execution and injection [16]. Clients browsing through that balancer are then served the malicious content, which closes the watering-hole loop [17].
Rapid7's initial-access hypothesis leans on Kimsuky, which it says has been exploiting RCE flaws in externally accessible mail servers to compromise South Korean groupware vendors since the beginning of 2026 [12]. The attribution for the toolkit itself leans on C2 overlap with APT37 [11]. The report cites two separate DPRK clusters for two different parts of the same finding, and names no CVE for either.
On dating, the source gives two fixed points. The HAProxy 2.8.12-0fdb194 build was released on 22 November 2024, which is the earliest date the plugin could have been compiled against it [8], and the earliest VirusTotal uploads are mid-2025 [7]. That is a compile window of roughly seven months [20], against campaign activity Rapid7 places back to early 2025 [10].
What that leaves defenders is thin on indicators and specific on files. This material publishes one SHA-256, for the SSH keylogger [14]. A filter plugin built into the same service version the operator installed does not add a process to the process table, and legitimate load balancing keeps working while it runs [4]. So the check that matches the finding is comparing what is running on the edge against what the package should have put there: HAProxy first, then crond, agetty, atd, sshd and polkitd [2]. That gap means endpoint telemetry alone would not have surfaced this activity.
Rapid7 also says ted may belong to a wider framework that includes an nginx backdoor [19]. If that lands with samples, the same reasoning applies to a much larger installed base.
