APT37 Ted Backdoor + CL-CRI-1171 PPI Nexus: OTX Pulse Detection Pack — Trojanized Linux Daemons, HAProxy Implants, SEO Poisoning

Two TLP:white OTX pulses, both modified in the first week of September 2026, show different ecosystems converging on the same enterprise risk: durable access with low detection pressure. The first pulse attributes a stealthy Linux toolkit to DPRK APT37 against South Korean media and automotive organizations. The second tracks CL-CRI-1171, a commodity pay-per-install operation hiding behind SEO poisoning, YouTube gamer funnels, disposable domains, and a stack of loaders, RATs, tunnelers, hijackers, cleaners, and proxy bots.

Treat these as separate actor sets but complementary defensive priorities: one demonstrates patient Linux persistence inside trusted daemons; the other shows how commodity infrastructure becomes initial access for government, energy, and corporate endpoints.

Threat Summary

The APT37 pulse describes a previously undocumented Linux toolkit active since early 2025 with minimal detection. The core implant is a HAProxy-based component called ted backdoor, reportedly compiled into the victim's existing HAProxy 2.8.12 deployment rather than dropped as an obvious new service. It is paired with trojanized versions of high-trust Linux binaries: crond, agetty, atd, sshd, and polkitd. That combination gives the operator remote command execution, scheduled-task control, session and authentication surface manipulation, privilege pathway abuse, and persistence that looks like normal system administration. Associated malware names in the pulse are ted backdoor and curlRAT, with tags indicating watering-hole activity, trojanized binaries, South Korea targeting, and a broader Linux toolkit.

The CL-CRI-1171 pulse is a high-volume cybercrime and access-broker style operation. Unit42's referenced analysis describes a campaign active for at least two years using a pay-per-install marketplace and commodity infrastructure to distribute OfferLoader, Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz. The lure strategy is deliberately bifurcated: young gamers are harvested through YouTube channels with large follower counts, while SEO poisoning pushes corporate and critical-infrastructure endpoints toward malicious downloads. The campaign's scale is reflected by 328 indicators in the pulse sample, dominated by domains and hostnames such as basesfile.com, uy.basesfiles.com, dolldebt.xyz, fangbear.xyz, memorycompany.xyz, suitsoap.xyz, truckshat.xyz, and boatthought.xyz.

Collectively, the pulses reveal three operational lessons. First, Linux edge and application infrastructure is now a first-class persistence target, not merely a pivot. Second, commodity PPI networks can deliver multiple malware families and still remain under-tracked because domains are disposable and payloads are modular. Third, sector lists matter: media and automotive organizations should prioritize APT37-style Linux integrity checks, while government and energy defenders should assume SEO-poisoned software searches and gamer-adjacent lures can become enterprise access.

Threat Actor / Malware Profile

APT37 — ted backdoor and curlRAT Linux toolkit

Attribution in the pulse points to DPRK APT37. The operation targets South Korean media and automotive sectors and has reportedly run since early 2025 with minimal detection. The distribution method is consistent with watering-hole or supply-path compromise followed by replacement or patching of legitimate Linux services. The signature behavior is not noisy process injection; it is the co-option of binaries that are expected to exist, run as root or system, and survive reboots.

The ted backdoor is described as a HAProxy instance compiled within the victim's existing HAProxy 2.8.12. That implies the implant may inherit normal listening ports, TLS handling, process names, service unit files, and log context. Payload behavior includes remote command execution and likely proxy-aware traffic blending, where C2 can ride ordinary web service flows. curlRAT, as named, suggests a lightweight remote access capability that may use libcurl-style HTTPS requests, cloud or CDN fronting, and configurable beaconing rather than a custom noisy protocol.

Persistence is the centerpiece: trojanized crond and atd can execute scheduled jobs; agetty and sshd can capture or broker interactive sessions; polkitd can alter privilege decisions; HAProxy can both terminate traffic and hide command channels. Anti-analysis is achieved through legitimacy: same paths, same service names, same package lineage, long dwell time, and operation inside daemons that defenders hesitate to rebuild. Detection should therefore focus on integrity drift, unexpected child processes from daemons, new sockets on service binaries, and hash mismatches against vendor or gold-image packages.

CL-CRI-1171 — PPI marketplace malware stack

CL-CRI-1171 is tracked as a massive cybercrime campaign using a pay-per-install marketplace. The loader and delivery layer is associated with OfferLoader and GCleaner, with follow-on families including Insomnia RAT for remote control, ARKTunnel for tunneling or proxy movement, Docro Hijacker for browser or document workflow hijacking, and Socks5Systemz for turning compromised endpoints into proxy nodes. The target profile spans young gamers on YouTube and, more concerning for enterprises, government and energy users reached through SEO poisoning and software-search manipulation.

Distribution is economics-driven: PPI operators buy installs from traffic sources, malvertising, cracked software, cheat downloads, SEO pages, and creator-adjacent links. Payload behavior is modular. A loader first fingerprints the host, then pulls whatever payload has the highest market value for that victim: RAT access, browser hijack monetization, residential proxy enrollment, cleanup masquerade, or tunneling for later resale. C2 is commodity but resilient: disposable .xyz and .com domains, hostnames under parent domains, frequent rotation, and enough shared infrastructure to appear in one pulse with 328 indicators.

Persistence on Windows is typically achieved through run keys, scheduled tasks, services, browser extension or policy abuse, WMI subscription, and masqueraded updater folders. Anti-analysis usually includes installer-only execution windows, geofencing, sandbox or VM checks, packed loaders, delayed payload retrieval, and separation between loader and final RAT so hash blocking alone does not kill the campaign.

IOC Analysis

The APT37 pulse provides file-hash indicators, with a sample of eight SHA256 values from a total of 26. These are high-fidelity for endpoint and file integrity detection but fragile if the actor recompiles per victim. Use them for EDR blocklists, retro-hunts across package caches and /usr/sbin, and comparison against gold images. Do not rely on hashes alone for HAProxy implants because the pulse indicates compilation into the victim's existing HAProxy build; also hunt for changed binary size, package-manager verification failures, unexpected extended attributes, and daemon-spawned shells.

The CL-CRI-1171 pulse provides domain and hostname indicators, with 328 total and a sample including basesfile.com, uy.basesfiles.com, dolldebt.xyz, fangbear.xyz, memorycompany.xyz, suitsoap.xyz, truckshat.xyz, and boatthought.xyz. Domains are operationally useful for DNS sinkholing, proxy blocking, TLS SNI inspection, and retro DNS log pivots, but they age quickly. Operationalize by resolving current and historical passive DNS, extracting registration and nameserver patterns, watching for domain-generation or word-pair naming, and alerting on any endpoint that queries a known domain plus downloads an executable within five minutes.

Recommended tooling: MISP or OpenCTI for pulse ingestion, otxv2 or DirectConnect for indicator sync, Microsoft Sentinel TI or Splunk Enterprise Security for correlation, CrowdStrike/MDE/SentinelOne custom IOC lists for hash enforcement, Pi-hole or Infoblox for DNS control, Zeek for SNI and JA3/JA4 clustering, CyberChef for string and config extraction, YARA for family clustering, and rpm -Va, debsums, AIDE, Tripwire, or osquery for Linux integrity drift.

Detection Engineering

---
title: APT37 Trojanized Linux Daemon Binary Integrity or Execution
id: 9f2a1c10-7f2d-4d2a-9e6a-apt37linux001
status: experimental
description: Detects execution or hash match of trojanized crond, agetty, atd, sshd, polkitd, or HAProxy associated with APT37 ted backdoor and curlRAT activity.
author: Security Arsenal Threat Intel
date: 2026/09/09
references:
  - https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
logsource:
  category: process_creation
  product: linux
detection:
  selection_images:
    Image|endswith:
      - /haproxy
      - /crond
      - /cron
      - /agetty
      - /atd
      - /sshd
      - /polkitd
  selection_hashes:
    Hashes|contains:
      - SHA256=5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91
      - SHA256=09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe
      - SHA256=fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61
      - SHA256=83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130
      - SHA256=7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110
      - SHA256=6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53
      - SHA256=ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16
      - SHA256=feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3
  selection_cli:
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'base64'
      - '/tmp/'
      - '/dev/shm/'
      - 'chattr'
      - 'systemctl restart'
  condition: selection_images and (selection_hashes or selection_cli)
falsepositives:
  - Legitimate package upgrades, configuration management, and daemon restarts.
level: high
tags:
  - attack.persistence
  - attack.t1053
  - attack.t1543
  - attack.t1071.001
  - attack.t1027
---
title: HAProxy or System Daemon Spawning Shell or Network Tool
id: 9f2a1c10-7f2d-4d2a-9e6a-apt37linux002
status: experimental
description: Identifies suspicious child processes spawned by HAProxy or core Linux daemons, consistent with ted backdoor remote command execution.
author: Security Arsenal Threat Intel
date: 2026/09/09
references:
  - https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - /haproxy
      - /sshd
      - /crond
      - /atd
      - /agetty
      - /polkitd
  selection_child:
    Image|endswith:
      - /sh
      - /bash
      - /dash
      - /curl
      - /wget
      - /python
      - /perl
      - /nc
      - /socat
      - /busybox
  filter_known:
    CommandLine|contains:
      - 'logrotate'
      - 'fail2ban'
      - 'certbot renew'
      - 'packagekit'
  condition: selection_parent and selection_child and not filter_known
falsepositives:
  - Admin automation, monitoring plugins, backup agents, and certificate renewal hooks.
level: critical
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1105
  - attack.command_and_control
---
title: CL-CRI-1171 PPI Domain or Loader Network Activity
id: 9f2a1c10-7f2d-4d2a-9e6a-clcri1171003
status: experimental
description: Detects DNS or network connections to sampled CL-CRI-1171 domains and loader delivery behavior linked to OfferLoader, Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz.
author: Security Arsenal Threat Intel
date: 2026/09/09
references:
  - https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/
logsource:
  category: dns_query
  product: windows
detection:
  selection_dns:
    QueryName|contains:
      - basesfile.com
      - basesfiles.com
      - dolldebt.xyz
      - fangbear.xyz
      - memorycompany.xyz
      - suitsoap.xyz
      - truckshat.xyz
      - boatthought.xyz
  selection_proc:
    Image|endswith:
      - \powershell.exe
      - \wscript.exe
      - \mshta.exe
      - \rundll32.exe
      - \regsvr32.exe
      - \curl.exe
  condition: selection_dns or selection_proc
falsepositives:
  - Threat research, DNS sinkhole verification, security tooling, and ad-block telemetry.
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1105
  - attack.t1566
  - attack.t1189

let Hashes = dynamic(['5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91','09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe','fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61','83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130','7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110','6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53','ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16','feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3']);
let BadDomains = dynamic(['basesfile.com','basesfiles.com','uy.basesfiles.com','dolldebt.xyz','fangbear.xyz','memorycompany.xyz','suitsoap.xyz','truckshat.xyz','boatthought.xyz']);
let DaemonNames = dynamic(['haproxy','crond','cron','agetty','atd','sshd','polkitd']);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any (DaemonNames) or InitiatingProcessFileName has_any (DaemonNames) or SHA256 in~ (Hashes)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, FolderPath),
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (BadDomains) or RemoteIP in (todynamic(externaldata(RemoteIP:string)[*]))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol),
(DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType has_any ('DnsQueryResponse','NetworkConnection','ProcessCreated')
| extend Parsed = parse_json(AdditionalFields)
| extend DnsName = tostring(Parsed.DnsQueryName), TargetHash = tostring(Parsed.SHA256)
| where DnsName has_any (BadDomains) or TargetHash in~ (Hashes)
| project TimeGenerated, DeviceName, ActionType, FileName, DnsName, TargetHash, AdditionalFields)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, FileName, InitiatingProcessFileName, RemoteUrl, SHA256
| order by LastSeen desc

#!/usr/bin/env bash
# Security Arsenal OTX hunt: APT37 Linux toolkit + CL-CRI-1171 domain reachability
set -euo pipefail

BAD_SHA256='5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91
09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe
fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61
83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130
7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110
6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53
ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16
feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3'

BAD_DOMAINS='basesfile.com basesfiles.com uy.basesfiles.com dolldebt.xyz fangbear.xyz memorycompany.xyz suitsoap.xyz truckshat.xyz boatthought.xyz'
WATCH_BINS='/usr/sbin/haproxy /usr/sbin/crond /usr/sbin/cron /usr/sbin/crond /sbin/agetty /usr/sbin/atd /usr/sbin/sshd /usr/lib/polkit-1/polkitd /usr/libexec/polkitd'

echo '[*] Hash sweep for watched daemon paths'
for f in $WATCH_BINS; do
  if [ -f "$f" ]; then
    h=$(sha256sum "$f" | awk '{print $1}')
    if echo "$BAD_SHA256" | grep -qx "$h"; then echo "[!] OTX hash match: $f $h"; fi
  fi
done

echo '[*] Package integrity drift'
if command -v rpm >/dev/null 2>&1; then rpm -Va 2>/dev/null | egrep 'haproxy|cron|openssh|policykit|util-linux|at' || true; fi
if command -v debsums >/dev/null 2>&1; then debsums -c 2>/dev/null | egrep 'haproxy|cron|openssh|policykit|util-linux|at' || true; fi

echo '[*] Daemon-spawned shells, curl, wget, base64 in recent auth/syslog'
grep -E 'haproxy|crond|cron|sshd|atd|agetty|polkitd' /var/log/auth.log /var/log/secure /var/log/syslog /var/log/messages 2>/dev/null | egrep -i 'bash|sh -c|curl|wget|base64|/tmp|/dev/shm|command' | tail -200 || true

echo '[*] Listening sockets owned by watched processes'
ss -ltnp 2>/dev/null | egrep 'haproxy|sshd|crond|atd|agetty|polkitd' || true

echo '[*] Unexpected cron, at, systemd, and rc persistence'
for d in /etc/cron.d /etc/cron.daily /etc/cron.hourly /var/spool/cron /var/spool/at /etc/systemd/system /usr/lib/systemd/system /etc/rc.d /etc/init.d; do
  if [ -d "$d" ]; then find "$d" -type f -mtime -120 -print0 2>/dev/null | xargs -0 -r grep -Ei 'curl|wget|base64|/tmp|/dev/shm|haproxy|ted|http://|https://' || true; fi
done

echo '[*] DNS cache and resolver evidence for CL-CRI-1171 sample domains'
for dom in $BAD_DOMAINS; do
  getent hosts "$dom" >/dev/null 2>&1 && echo "[!] resolves locally: $dom" || true
  grep -R "$dom" /var/log 2>/dev/null | tail -20 || true
done

echo '[*] HAProxy build and config anomalies'
if command -v haproxy >/dev/null 2>&1; then haproxy -vv 2>/dev/null | egrep -i 'version|build|openssl|pcre|lua' || true; fi
grep -RniE 'bind |ssl crt|http-request|tcp-request|lua|chroot|stats socket|external-check|insecure|127.0.0.1' /etc/haproxy 2>/dev/null | tail -200 || true

echo '[*] Done. Escalate any hash match, unknown daemon socket, recent persistence change, or CL-CRI-1171 domain resolution.'

Response Priorities

Immediate: contain and confirm

Block the eight sampled SHA256 values across EDR, application control, email detonation, and web isolation even though the APT37 pulse lists 26 total indicators; request and ingest the full set. DNS-block and proxy-deny the CL-CRI-1171 sample domains and parent patterns, then pivot into passive DNS for sibling domains registered or resolved in the same windows. On Linux servers, isolate any host where haproxy, sshd, crond, atd, agetty, or polkitd fails package verification, spawns shells, opens unexpected listeners, or was modified outside a change window. Capture volatile memory and preserve /proc maps, service unit files, cron spools, at jobs, package manager logs, HAProxy binaries and configs, and recent auth logs before remediation. On Windows endpoints, quarantine hosts with PPI-domain lookups followed by executable download, Office or script interpreter launch, new browser policies, or unexpected Socks5 listeners.

24 hours: identity, session, and exposure validation

Because sshd, agetty, and polkitd are implicated, force credential and key rotation for any account that authenticated to a suspected Linux host, prioritizing root-equivalent sudoers, service accounts, CI/CD deploy keys, and administrators with media or automotive production access. Review SSH authorized_keys, PAM stack changes, polkit rules, sudo logs, session recordings, and impossible-travel events. For CL-CRI-1171 exposure, reset credentials for users who installed gamer-oriented tools, cracked software, browser extensions, SEO-poisoned utilities, or cleaner apps; inspect cookies and token stores where Docro Hijacker or browser abuse is suspected. Check whether endpoints became Socks5Systemz nodes and review egress for proxy resale traffic, unusual UDP/TCP relay volume, and connections from external IPs into workstation tunnels.

1 week: harden against the two vectors

For APT37-style Linux compromise, rebuild rather than patch any host with daemon integrity drift; pin HAProxy and core packages to vendor-signed repositories; enable package verification in configuration management; deploy file integrity monitoring on /usr/sbin, /sbin, /etc/systemd/system, cron and at spools, polkit rules, and HAProxy directories; restrict daemon child processes with SELinux or AppArmor; require EDR network provenance for outbound curl and wget; and separate HAProxy management from data-plane hosts. For CL-CRI-1171, enforce browser isolation for high-risk search and download behavior, block cracked-software and cheat categories, add YouTube or creator-link detonation for software downloads, tighten SEO-poisoning monitoring for brand and driver searches, disable unsigned sideloaded extensions, alert on new Socks5 proxy listeners, and convert the 328-domain pulse into a rolling detection set with confidence decay rather than a static blocklist.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub