#lazarus
2 cases
ted backdoor: North Korea hides a Linux implant inside victims' HAProxy load balancersState-SponsoredMalware
Rapid7 found 'ted', a backdoor a DPRK-linked APT compiled into victims' HAProxy load balancers as a native plugin — reading their decrypted traffic and routing C2 through the load balancer itself. A companion CurlRAT toolkit hid in five trojanized Linux daemons; targets were South Korean firms.
State-SponsoredMalware
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software CompromiseSupply Chain AttackState-Sponsored
A North Korean-linked actor compromised Trading Technologies' X_TRADER, used it to breach 3CX, and shipped signed, trojanised VoIP clients to its customers — the first documented case of one software supply chain attack causing another.
Supply Chain AttackState-Sponsored