North Korean-Linked Actors Compile Custom HAProxy Plugin Into Victim Load Balancers for Long-Term Surveillance

The toolkit integrates a filter plugin into HAProxy's native API for traffic interception, script injection, and C2 polling while preserving legitimate load-balancing functions. Initial access came via a Groupware portal flaw, followed by SSH keylogger deployment for credential harvesting and lateral movement. Artifacts include commodity TLD domains mimicking Naver static content and stagers that check for crond or HAProxy before dropping payloads.

Technical evidence shows code reuse with prior APT37 and Lazarus watering-hole infrastructure, including domain registration patterns and payload delivery blending into web traffic. The campaign timeframe overlaps Operation SyncHole but lacks independent confirmation of shared C2 servers or identical binaries. Official attribution to North Korean groups rests on behavioral similarity rather than cryptographic or infrastructure linkage.

The approach demonstrates state actors shifting from commodity implants to deep integration with production services for persistence against monitoring. This raises detection thresholds for organizations relying on stock HAProxy deployments without memory forensics or build-integrity checks.

Next steps include expanded scanning for HAProxy instances with anomalous filter plugins and monitoring for CurlRAT polling at 12-hour intervals on exposed load balancers.