North Korean-linked hackers infiltrate South Korean firms via HAProxy backdoor

A newly uncovered Linux‑based espionage toolkit, which security analysts tie to North Korean‑aligned threat actors with medium confidence, has been used to place a backdoor on HAProxy load‑balancing servers employed by several South Korean companies in the automotive and media industries.

HAProxy is a widely deployed open‑source proxy and load balancer that sits at the front of web traffic, directing requests to backend services. By compromising the HAProxy instance, attackers gain a privileged foothold that lets them monitor, intercept, and manipulate network flows across an entire organization without needing to exploit a vulnerability in the software itself.

The campaign, first reported by the research collective GBHackers, does not rely on a software flaw; instead the malicious actors gain access through credential theft or misconfiguration and then install a custom backdoor component. The toolkit’s code shares markers—such as specific command‑and‑control strings and file‑system layouts—with previous samples attributed to groups known to operate on behalf of the Democratic People’s Republic of Korea, prompting analysts to assign a medium level of confidence to the link.

Targeted firms in the automotive sector reported anomalous outbound traffic that coincided with the deployment of the HAProxy backdoor, raising concerns about the theft of design schematics, supply‑chain data, and production schedules. Media companies, whose operations depend on rapid content delivery, risked exposure of unpublished material and audience analytics. Both sectors are of strategic interest to the DPRK, which has historically sought intelligence that could support its military‑industrial ambitions and information‑war objectives.

Security teams across South Korea have begun a coordinated response, resetting HAProxy credentials, tightening network segmentation, and conducting forensic reviews of affected systems. Researchers advise organizations that rely on HAProxy to audit configuration files, enforce multi‑factor authentication for administrative access, and monitor for the distinctive backdoor binaries. As attribution efforts continue, the incident underscores the growing sophistication of state‑aligned cyber actors who prefer stealthy persistence over flashy exploits, prompting a reassessment of defensive priorities for critical infrastructure.