The ted/CurlRAT HAProxy toolkit is North Korean

Assessment

Coverage frames the ted backdoor and CurlRAT toolkit as North Korean. Rapid7's own attribution is medium confidence: the command-and-control infrastructure is associated with APT37 by ThreatFox and maltrail, and the tradecraft overlaps documented APT37 (Operation Code on Toast) and Lazarus (Operation SyncHole) activity against South Korean organizations. But Rapid7 explicitly states that 'further evidence is necessary to make a more definitive assessment,' and does not resolve whether APT37, Lazarus, or another DPRK unit is responsible — APT37 and Lazarus sit under different DPRK agencies and both run parallel espionage against South Korea. So the DPRK direction of travel is well-supported, but a headline that presents a single confirmed North Korean group is more certain than the evidence, which places responsibility on a cluster whose exact identity is still open.