DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

North Korean APTs have deployed highly sophisticated, stealthy Linux backdoors—ted and curlRAT—against South Korean media and automotive sectors, leveraging trojanized system daemons and HAProxy to enable long-term espionage, credential theft, and targeted payload delivery while evading detection and blending seamlessly into legitimate infrastructure.