GoKawiilRapid7 links suspected North Korean hackers to breach of South Korean media, auto firms
Rapid7 reports that a stealthy espionage campaign has compromised South Korean automotive and media companies since early 2025, with medium-confidence attribution to North Korean APT37 based on overlapping command-and-control infrastructure. The attackers exploited the open-source HAProxy load balancer to install a custom Linux toolkit called TED, granting them visibility into and control over victims' network traffic.
GoKawiil's interpretation of the reporting above, not reported fact.
Targeting media outlets suggests an interest in surveilling journalists and controlling information, while hitting automotive firms points to theft of manufacturing and technology secrets — a dual-purpose intelligence operation. The use of infrastructure-level compromise via load balancer software shows North Korean-linked actors evolving toward harder-to-detect, network-wide access rather than simple endpoint intrusions.
- Attackers exploited HAProxy load balancers to install a stealthy Linux toolkit called TED for long-term network access.
- Rapid7 attributes the campaign with medium confidence to North Korean APT37 based on C2 server overlap.
- The dual focus on media and automotive sectors points to combined espionage and industrial-intelligence goals.
YubiKey 5 NFC Security Key — With APT groups targeting corporate networks in media and automotive sectors, hardware-based multi-factor authentication like YubiKey is a practical defense against credential theft and phishing that often precedes these intrusions. It's a simple, durable device that IT teams can deploy widely to harden account security against nation-state actors.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Robert Lemos, 2026-09-16
Published there as: “Cyber Op Targets South Korean Media & Automotive Sectors”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.