APT37 'Ted' Backdoor Linux Toolkit + Abyssos RAT: OTX Pulse Analysis — Infostealer Detection Pack | Security Arsenal

Two fresh OTX pulses paint a consistent picture: adversaries are investing heavily in stealthy, low-detection tooling built specifically to harvest credentials and maintain long-haul access inside enterprise networks. One is a state-sponsored Linux implant hiding inside legitimate HAProxy binaries; the other is a brand-new modular RAT with credential theft as a first-class capability. Both demand immediate detection engineering.

Threat Summary

These two pulses, while distinct campaigns, reveal a converging tradecraft trend: credential access through deeply embedded, low-noise implants.

Campaign 1 — APT37 (DPRK) / Ted Backdoor + curlRAT: Rapid7 research surfaced via OTX documents a previously undocumented Linux toolkit targeting South Korean media and automotive organizations since early 2025 with minimal antivirus detection. The centerpiece is the ted backdoor, a malicious HAProxy instance compiled directly into the victim's existing HAProxy 2.8.12 build — meaning the backdoor inherits the legitimacy, permissions, and network posture of a trusted load balancer. Alongside it, APT37 trojanized core system daemons: crond, agetty, atd, sshd, and polkitd. Trojanizing sshd and agetty is a direct credential-harvesting play: both binaries sit in the authentication path and can capture plaintext usernames and passwords at login. The attack chain appears to involve watering-hole delivery (per pulse tags), followed by replacement of legitimate system binaries, enabling remote command execution and credential interception that persists across reboots and survives most file-integrity monitoring that only watches application-layer paths.

Campaign 2 — Abyssos RAT: Zscaler's analysis of Abyssos (first seen late June 2026) describes a modular C++ remote administration tool with credential theft, file exfiltration, and VNC-based remote access. Its operators lean on LLVM-based obfuscation — control flow flattening and string encryption — to blind static scanners and slow reverse engineering. C2 runs over a custom TCP protocol, dodging signature-based network detections tuned for HTTP/S beacons.

Collective objective: Both toolsets are built for the same endgame — silent, durable access and credential collection that feeds downstream intrusion, espionage, or broker activity. Credentials stolen via trojanized sshd/agetty or a RAT's harvester module historically surface in dark web credential markets and initial-access broker listings, making this directly relevant to credential exposure monitoring.

Threat Actor / Malware Profile

APT37 (a.k.a. Reaper, ScarCruft, Ricochet Chollima)

Attribution: DPRK state-sponsored; long history of targeting South Korean entities, defectors, journalists, and industrial sectors.
Distribution: Watering-hole compromise per pulse tags, with post-compromise deployment of the Linux toolkit onto internet-facing or DMZ infrastructure running HAProxy.
Payload behavior: ted is embedded inside a trojanized HAProxy 2.8.12 binary — it proxies legitimate traffic normally while exposing covert remote command execution. Companion RAT curlRAT (named for its use of curl/libcurl-style network behavior) handles tasking.
Persistence: Trojanized replacements for crond, atd, agetty, sshd, and polkitd — persistence is the operating system. Replacing init-adjacent daemons guarantees execution on boot and on every authentication event.
Credential theft: Trojanized sshd and agetty intercept authentication flows, capturing plaintext credentials before hashing/session establishment.
Anti-analysis: Running inside legitimate, version-matched binaries defeats hash-based allowlists and casual integrity checks; minimal AV detection since early 2025 confirms efficacy.

Abyssos RAT

Attribution: Unknown actor; first identified late June 2026.
Distribution: Not yet fully documented; modular loader architecture suggests staged delivery via dropper.
Payload behavior: Modular C++ RAT with credential theft, file exfiltration, and interactive VNC remote access (hVNC-style hidden desktop is typical for this class).
C2 communication: Custom TCP protocol — no HTTP semantics, defeating web-proxy-centric detections and JA3/JA4 TLS fingerprinting.
Persistence: Module-based; expect registry Run keys or scheduled task establishment consistent with commodity RAT behavior.
Anti-analysis: LLVM obfuscation (control flow flattening, string encryption) inflates basic-block counts and hides plaintext indicators from static signatures.

IOC Analysis

The pulses are hash-dominant — 26 SHA256 indicators for the APT37 toolkit and 2 for Abyssos, with no network IOCs published in these samples. That profile has operational implications:

FileHash-SHA256 (28 total): The ted backdoor hashes cover the trojanized HAProxy build and replaced daemon binaries; the Abyssos hashes cover the loader and core module. Hash matching alone is fragile here — APT37 compiles per-victim (matching the target's exact HAProxy version), so hashes will not generalize across victims. Treat these hashes as retrospective confirmation (did WE get hit by the documented samples?) rather than forward-looking blocks.
Operationalization:
1. Push all 28 SHA256 values into your EDR blocklist and threat-intel platform (MISP, OpenCTI, Sentinel TIP) immediately for retro-hunting.
2. Because hash reuse is unlikely, pivot to behavioral detection (below): the durable signals are unexpected recompilation/replacement of system daemons, HAProxy spawning shells, and raw custom-TCP C2 on non-standard ports.
3. On Linux estate, run integrity checks (debsums, rpm -Va, AIDE/OSQuery file carve) against haproxy, sshd, crond, atd, agetty, polkitd — any binary whose hash deviates from the package manager's record is a P1 finding.
Tooling: yara + clamav for sample scanning; osquery for fleet-wide file integrity; ssdeep/imphash for variant clustering against the ted samples; WireGuard/Zeek conn.log anomaly review for Abyssos-style raw TCP beacons.

Detection Engineering

YAML

---
title: APT37 Ted Backdoor - Trojanized HAProxy Spawning Shell or Suspicious Child Process
id: 7c1f2a90-3b8e-4d6a-9f2e-1a5c8d3e7b01
status: experimental
description: Detects HAProxy (potentially trojanized per APT37 ted backdoor tradecraft) spawning shells or interpreters. Legitimate HAProxy never spawns interactive child processes. Covers the embedded remote command execution capability of the ted backdoor compiled into HAProxy 2.8.12.
author: Security Arsenal Threat Intelligence
references:
    - https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
date: 2026/09/09
logsource:
    category: process_creation
    product: linux
    service: auditd
detection:
    selection_parent:
        ParentImage|endswith: '/haproxy'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/python'
            - '/python3'
            - '/perl'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
    condition: selection_parent and selection_child
falsepositives:
    - None expected. HAProxy does not legitimately fork shells in production.
level: critical
tags:
    - attack.execution
    - attack.t1059
    - attack.t1071
---
title: Unauthorized Replacement of Critical Linux System Daemons (sshd, crond, agetty, atd, polkitd)
id: 9e4b6c21-8f3a-4c7d-b1e9-6d2a5f8c3e44
status: experimental
description: Detects write/rename/modify operations against authentication and scheduling daemons trojanized by the APT37 Linux toolkit (ted backdoor campaign). Legitimate modification should only occur via package manager updates; direct writes by other processes indicate binary replacement persistence.
author: Security Arsenal Threat Intelligence
references:
    - https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
date: 2026/09/09
logsource:
    category: file_event
    product: linux
    service: auditd
detection:
    selection_target:
        TargetFilename|endswith:
            - '/usr/sbin/sshd'
            - '/usr/sbin/crond'
            - '/usr/sbin/cron'
            - '/usr/sbin/atd'
            - '/sbin/agetty'
            - '/usr/lib/polkit-1/polkitd'
            - '/usr/sbin/haproxy'
            - '/usr/sbin/haproxy-systemd-wrapper'
    filter_package_mgr:
        Image|endswith:
            - '/dpkg'
            - '/apt'
            - '/apt-get'
            - '/rpm'
            - '/yum'
            - '/dnf'
    condition: selection_target and not filter_package_mgr
falsepositives:
    - Configuration management tooling (Ansible, Puppet) performing binary deployment outside package managers - rare and should be allowlisted explicitly
level: critical
tags:
    - attack.persistence
    - attack.t1554
    - attack.t1574
---
title: Abyssos RAT - Raw TCP C2 Beacon to Non-Standard Port with Periodic Cadence
id: 3a8d5f62-1c4b-4e9a-a7d3-2b6c9e1f5a88
status: experimental
description: Detects processes (excluding browsers and known services) establishing repeated outbound TCP connections to rare external IPs on non-standard ports, consistent with Abyssos custom TCP protocol C2. Abyssos avoids HTTP/S, making raw-socket beaconing its primary network signature.
author: Security Arsenal Threat Intelligence
references:
    - https://www.zscaler.com/blogs/security-research/abyssos-technical-analysis-new-modular-rat
date: 2026/09/09
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        DestinationPort:
            - 4444
            - 5555
            - 6666
            - 7777
            - 8888
            - 9999
            - 1337
            - 31337
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Game clients, development tools, and legitimate custom-protocol enterprise apps - baseline destination IPs before alerting
level: high
tags:
    - attack.command_and_control
    - attack.t1095
    - attack.t1571

KQL — Microsoft Sentinel / Defender

// Hunt: Trojanized daemon replacement (APT37 ted backdoor) + Abyssos raw-TCP C2 + credential theft staging
// Scope: Microsoft Defender for Endpoint fleet, last 14 days
let Lookback = 14d;
let TedHashes = dynamic([
    "5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91",
    "09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe",
    "fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61",
    "83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130",
    "7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110",
    "6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53",
    "ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16",
    "feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3"]);
let AbyssosHashes = dynamic([
    "52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa",
    "ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173"]);
// Part 1: Hash retro-hunt - any file matching published OTX indicators
let HashHits = DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in~ (TedHashes) or SHA256 in~ (AbyssosHashes)
    | extend Campaign = iff(SHA256 in~ (TedHashes), "APT37-TedBackdoor", "Abyssos-RAT")
    | project HashHits_Time=TimeGenerated, Campaign, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName;
// Part 2: Behavioral - HAProxy or auth daemons spawning shells/interpreters (Linux via MDE)
let DaemonShell = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any ("haproxy", "sshd", "crond", "agetty", "atd", "polkitd")
    | where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
    | project DaemonShell_Time=TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
// Part 3: Abyssos-style raw TCP C2 - non-browser processes on classic RAT ports to public IPs
let RawC2 = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (4444, 5555, 6666, 7777, 8888, 9999, 1337, 31337)
    | where RemoteIPType == "Public"
    | where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "svchost.exe")
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort
    | where Connections >= 3;
union HashHits, DaemonShell, RawC2
| sort by TimeGenerated desc

Bash / Shell

#!/bin/bash
# hunt_ted_abyssos.sh - Fleet hunt for APT37 ted backdoor (trojanized daemons) and credential theft artifacts
# Run as root on Linux hosts, especially DMZ/load-balancer infrastructure

RED='\033[0;31m'; GRN='\033[0;32m'; NC='\033[0m'
FOUND=0

echo "[+] === APT37 Ted Backdoor / Trojanized Daemon Hunt ==="
echo "[+] Host: $(hostname) | Date: $(date -u)"

# 1. Package integrity check on binaries APT37 is known to trojanize
echo ""
echo "[*] Verifying package integrity of critical daemons..."
TARGETS="haproxy openssh-server cron cronie at atd util-linux policykit-1 polkitd"
if command -v rpm &>/dev/null; then
    for pkg in $TARGETS; do
        OUT=$(rpm -Va "$pkg" 2>/dev/null | grep -E '^.{8}5')  # '5' = md5/sha mismatch
        [ -n "$OUT" ] && { echo -e "${RED}[!] MODIFIED (rpm): $OUT${NC}"; FOUND=1; }
    done
elif command -v debsums &>/dev/null; then
    OUT=$(debsums -c 2>/dev/null | grep -E 'haproxy|sshd|crond|agetty|atd|polkitd')
    [ -n "$OUT" ] && { echo -e "${RED}[!] MODIFIED (debsums): $OUT${NC}"; FOUND=1; }
else
    echo "[-] No rpm/debsums available - perform manual hash comparison"
fi

# 2. Check OTX SHA256 indicators against on-disk daemon binaries
echo ""
echo "[*] Checking OTX pulse indicators against daemon binaries..."
declare -A IOC=(
["5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91"]="APT37-ted"
["09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe"]="APT37-ted"
["fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61"]="APT37-ted"
["83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130"]="APT37-ted"
["7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110"]="APT37-ted"
["6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53"]="APT37-ted"
["ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16"]="APT37-ted"
["feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3"]="APT37-ted"
["52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa"]="Abyssos"
["ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173"]="Abyssos"
)
for bin in /usr/sbin/haproxy /usr/sbin/sshd /usr/sbin/crond /usr/sbin/cron \
           /usr/sbin/atd /sbin/agetty /usr/lib/polkit-1/polkitd; do
    if [ -f "$bin" ]; then
        H=$(sha256sum "$bin" | awk '{print $1}')
        if [ "${IOC[$H]}" ]; then
            echo -e "${RED}[!!!] IOC MATCH [$bin] = ${IOC[$H]} ($H)${NC}"; FOUND=1
        fi
    fi
done

# 3. HAProxy spawning unexpected children (ted backdoor remote-exec behavior)
echo ""
echo "[*] Checking for HAProxy with suspicious child processes..."
HAPROXY_PIDS=$(pgrep -x haproxy 2>/dev/null)
for pid in $HAPROXY_PIDS; do
    KIDS=$(ps --ppid "$pid" -o comm= 2>/dev/null | grep -vE '^haproxy$')
    [ -n "$KIDS" ] && { echo -e "${RED}[!] haproxy PID $pid spawned: $KIDS${NC}"; FOUND=1; }
done

# 4. Recent modification timestamps on daemon binaries (replacement evidence)
echo ""
echo "[*] Checking for recently modified daemon binaries (last 90 days)..."
find /usr/sbin/sshd /usr/sbin/crond /usr/sbin/cron /usr/sbin/atd \
     /sbin/agetty /usr/lib/polkit-1/polkitd /usr/sbin/haproxy \
     -mtime -90 -type f 2>/dev/null | while read -r f; do
    echo -e "${RED}[!] Recently modified: $f ($(stat -c '%y' "$f" 2>/dev/null))${NC}"; FOUND=1
done

# 5. Anomalous outbound raw-TCP listeners/connections on RAT ports (Abyssos pattern)
echo ""
echo "[*] Checking for suspicious outbound connections on common RAT ports..."
ss -tnp 2>/dev/null | grep -E ':(4444|5555|6666|7777|8888|9999|1337|31337)\b' && FOUND=1

# 6. Credential theft artifact: anomalous sshd PAM modules / auth log gaps
echo ""
echo "[*] Checking sshd for injected PAM modules..."
grep -vE '^#|^$' /etc/pam.d/sshd 2>/dev/null | grep -viE 'common-auth|common-account|common-session|common-password|pam_systemd|pam_selinux|pam_env|pam_motd|pam_mail|pam_limits|pam_loginuid|pam_keyinit|pam_lastlog|pam_faildelay' && {
    echo -e "${RED}[!] Non-standard PAM module referenced in sshd config - investigate${NC}"; FOUND=1
}

echo ""
if [ $FOUND -eq 0 ]; then
    echo -e "${GRN}[OK] No ted backdoor / Abyssos indicators found on $(hostname)${NC}"
else
    echo -e "${RED}[ACTION REQUIRED] Findings present - isolate host, preserve memory, escalate to IR${NC}"
fi
exit $FOUND

Response Priorities

Immediate (0-4 hours):

Push all 28 OTX SHA256 indicators into EDR block/alert policies and your TIP; run retro-hunts across 12+ months of telemetry (the APT37 toolkit operated undetected since early 2025 — assume a long dwell window).
On all Linux infrastructure running HAProxy — especially version 2.8.12 — execute the bash hunt script. Prioritize DMZ, media/publishing, and automotive-adjacent systems if you operate in or partner with South Korean entities in those sectors.
Enable the Sigma rules for HAProxy child-process spawning and daemon binary replacement; these catch the behavior even when per-victim compiled hashes don't match.

24 hours:

Treat credentials on any host with a hit as compromised. Trojanized sshd/agetty captures plaintext passwords at login — every account that authenticated to a suspect host since binary modification must be force-reset, including service accounts and SSH key passphrases.
Audit for Abyssos credential theft exposure: check for unauthorized VNC/RDP sessions, credential-store access events (Mimikatz-style LSASS access on Windows hosts), and new local accounts.
Review outbound network logs for raw-TCP connections to rare IPs on non-standard ports from non-browser processes (Abyssos C2 pattern); block and sinkhole confirmed destinations.
Cross-reference harvested credential exposure against dark web credential monitoring — APT37 and RAT operators frequently monetize or broker access.

1 week:

Deploy file-integrity monitoring (AIDE, OSQuery, or EDR-native FIM) with alerting on any modification to sshd, crond, atd, agetty, polkitd, and haproxy outside of package-manager change windows.
Enforce package-signed binary verification at boot where possible (dm-verity, IMA appraisal) on critical Linux hosts; APT37's tradecraft specifically defeats trust in on-disk system binaries.
Restrict HAProxy and daemon egress: a load balancer has no legitimate need to spawn shells or initiate outbound connections to arbitrary internet IPs — apply egress allowlists.
For watering-hole exposure (per APT37 delivery tags), harden browser isolation and verify third-party script integrity on vendor/partner portals used by media and automotive business units.
Brief threat-hunt teams on the Abyssos custom-TCP profile; add Zeek/Suricata anomaly rules for periodic small-payload raw TCP beacons.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

APT37 'Ted' Backdoor Linux Toolkit + Abyssos RAT: OTX Pulse Analysis — Infostealer Detection Pack