72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558SHA-256 hash
Reported by 1 independent source · first reported by Rapid7 · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors“The TA recompiled the HAProxy build 2.8.12 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 (18MB) to include a custom plugin (named ted_plugin) leaving debug strings naming the backdoor.”
Indicators reported together
named in the same reports- 4bb923eb040aa13c…4a9168a065f5in 1 report
- c8c68e629bba773a10ac80012d10bf19in 1 report
- 5db1b6d52faf60b4…8357c08b6a91in 1 report
- 09739441ed4599ba…56d7384f3dbein 1 report
- fea1bc36632c71e5…9ade6df06e61in 1 report
- feeea9d0bf6ae739…56f91abc50b3in 1 report
- img.darklights[.]storein 1 report
- ecd427ea8330a4ff73618483e00b9b41in 1 report
- img.monderhouse[.]spacein 1 report
- haproxy[.]pidin 1 report
- 8f30b57928934ae6…4a88a0fdb66cin 1 report
- img.worksongo[.]storein 1 report
- img.socialteams[.]storein 1 report
- buf[.]datain 1 report
- a8bfab4de81a1acb…6d0e425119c7in 1 report
- img.responsive.pstatic[.]autosin 1 report
- 83f7d565b0465546…341147349130in 1 report
- 7007a78d50a993cb…712f613ec110in 1 report
- 6cf1b5e92a9c0756…52c639a8fc53in 1 report
- ed72f4cd8d467b5c…1a714727be16in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.