Two South Korean organizations (automotive and media sectors)

Date (as written): 04/09/2026
Year: 2026
Country: KR
Actors (as written): APT37 (North Korea; medium confidence)
Actor pages: APT37
Tags (as written): Attack: Malware; Target Class: C - Manufacturing J - Information and communication; Attack Class: Cyber Espionage; Initial Access: T1190 - Exploit Public-Facing Application

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Two South Korean organizations (automotive and media sectors) · 04/09/2026

Rapid7 discovers APT37 deploying previously undocumented Linux toolkit "ted" compiled into trojanized HAProxy load balancers at South Korean firms. The implant intercepted web traffic, served altered pages to selected visitors, and communicated via C2 channels. [Date Occurred: Since early 2025; Date Discovered: Since early 2025]

https://www.hackmageddon.com/2026/09/29/september-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/1sn0d9OIEXxw2D2hmWK69emA2dTuDXr0FeJba33JQUc4/export?format=csv&gid=0

https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html

Suggest a correction on GitHub