North Korea-Linked Hackers Turn Web Servers Into Stealthy Espionage Backdoors

The campaign targeted organizations in South Korea’s automotive and media sectors, using compromised edge servers to steal credentials, monitor victims, inject malicious content into web traffic, and maintain long-term access. At the center of the operation is a modified HAProxy load balancer, named the “ted backdoor.” Rather than deploying a...