04-09-2026
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
Report completeness: Medium
Actors/Campaigns:
Scarcruft (motivation: cyber_espionage)
Kimsuky
Code_on_toast
Operation_synchole
Lazarus (motivation: cyber_espionage)
Funnull
Threats:
Curlrat
Credential_harvesting_technique
Watering_hole_technique
Timestomp_technique
Victims:
Automotive sector, Media sector
Industry:
Transport
Geo:
South korea, Dprk, South korean
TTPs:
Tactics: 8
Technics: 20
IOCs:
Hash: 18
File: 6
Domain: 6
Soft:
Linux, HAProxy, nginx, Ubuntu, Apache Tomcat, Jenkins, Unix
Algorithms:
md5, xor, base64
Functions:
userauth_passwd, atd_get_info, ted_register_reload_signal_handler, ted_extra_log, trace_chn_start_analyze, ted_chn_analyze_for_htx_constprop_0, write, send, popen
Languages:
javascript
Links:
https://github.com/stamparm/maltrail/blob/master/trails/static/malware/apt\_37.txt