Malware

curlRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The partially reconstructed chain assumes exploitation of a vulnerability in the exposed Groupware login portal.

Execution

1 technique

T1059.004Unix ShellEvidence1

CurlRAT executes command lists via popen and supports reverse and interactive PTY shells; ted executes commands via popen.

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

The stager decrypts a trojanized crond binary in memory, overwrites the legitimate daemon, and restarts the service.

T1554Compromise Host Software BinaryEvidence1

The toolkit was compiled directly into trojanized HAProxy load balancers... installing it requires code execution on the host and the ability to replace the running binary.

Privilege Escalation

2 techniques

T1543Create or Modify System ProcessEvidence1

The stager decrypts a trojanized crond binary in memory, overwrites the legitimate daemon, and restarts the service.

T1548Abuse Elevation Control MechanismEvidence1

CurlRAT calls setuid(0) and setreuid(0, 0) before establishing a reverse shell; the stager verifies root privileges before deployment.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Configuration files and scripts use chained/feedback XOR and a substitution cipher; C2 data is encoded with XOR and Base64.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Trojanized binaries use crond, polkitd, agetty, and atd names, while CentOS functions are named atd_ routines.

T1480Execution GuardrailsEvidence1

The stager deploys only when HAProxy or cron is present; CurlRAT validates a victim token; ted uses scanner/IP and operator-key filtering.

T1497.001System ChecksEvidence2

The CurlRAT watchdog checks for /usr/lib/libvirtlog.so.0 and aborts after a delay if the file is absent.

Discovery

3 techniques

T1057Process DiscoveryEvidence1

The CurlRAT watchdog reads HAProxy PID information and polls /proc to identify started, stopped, restarted, and reloaded states.

T1082System Information DiscoveryEvidence1

The stager profiles hostname, OS, kernel, and CPU architecture; CurlRAT sends a 10 KB system-information beacon.

T1497.001System ChecksEvidence2

The CurlRAT watchdog checks for /usr/lib/libvirtlog.so.0 and aborts after a delay if the file is absent.

Collection

1 technique

T1560Archive Collected DataEvidence1

SSH-keylogger output is encrypted with a substitution cipher; CurlRAT encrypts and Base64-encodes outbound data.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

Output returns on the raw socket under a standard HTTP/1.0 200 OK header, which is what makes the exchange look like ordinary web traffic.

T1102Web ServiceEvidence1

CurlRAT uses img.monderhouse.space and img.darklights.store as fallback or backup configuration hosts.

T1132.001Standard EncodingEvidence1

CurlRAT Base64-encodes feedback-XOR-encrypted C2 payloads; ted uses rolling XOR for pipe-protocol data.

T1568Dynamic ResolutionEvidence1

CurlRAT derives an MD5 victim ID from the hostname, IP address, hardware/OS UUID, and cron version, then uses it in C2 headers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

CurlRAT streams command output over its C2 channel, while captured credentials and web-session data are staged for operator collection.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Sep 4, 2026

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Companion Linux remote-access trojan in the ted toolkit. It beacons at a default 12-hour interval, can be configured to beacon every 30 seconds, and only operates when a marker file indicates the infected host is virtualized.

rapid7 blogNews

Sep 4, 2026

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Linux remote-access framework embedded in trojanized system daemons including crond, agetty, atd, and polkitd. It profiles compromised hosts, derives a victim identifier, polls C2 infrastructure over HTTPS with HTTP fallback, executes commands, downloads staged payloads, provides root reverse and interactive PTY shells, and exfiltrates command output and host telemetry. Its HAProxy watchdog reports service state to the operator.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

curlRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The partially reconstructed chain assumes exploitation of a vulnerability in the exposed Groupware login portal.

Execution

1 technique

T1059.004Unix ShellEvidence1

CurlRAT executes command lists via popen and supports reverse and interactive PTY shells; ted executes commands via popen.

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

The stager decrypts a trojanized crond binary in memory, overwrites the legitimate daemon, and restarts the service.

T1554Compromise Host Software BinaryEvidence1

The toolkit was compiled directly into trojanized HAProxy load balancers... installing it requires code execution on the host and the ability to replace the running binary.

Privilege Escalation

2 techniques

T1543Create or Modify System ProcessEvidence1

The stager decrypts a trojanized crond binary in memory, overwrites the legitimate daemon, and restarts the service.

T1548Abuse Elevation Control MechanismEvidence1

CurlRAT calls setuid(0) and setreuid(0, 0) before establishing a reverse shell; the stager verifies root privileges before deployment.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Configuration files and scripts use chained/feedback XOR and a substitution cipher; C2 data is encoded with XOR and Base64.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Trojanized binaries use crond, polkitd, agetty, and atd names, while CentOS functions are named atd_ routines.

T1480Execution GuardrailsEvidence1

The stager deploys only when HAProxy or cron is present; CurlRAT validates a victim token; ted uses scanner/IP and operator-key filtering.

T1497.001System ChecksEvidence2

The CurlRAT watchdog checks for /usr/lib/libvirtlog.so.0 and aborts after a delay if the file is absent.

Discovery

3 techniques

T1057Process DiscoveryEvidence1

The CurlRAT watchdog reads HAProxy PID information and polls /proc to identify started, stopped, restarted, and reloaded states.

T1082System Information DiscoveryEvidence1

The stager profiles hostname, OS, kernel, and CPU architecture; CurlRAT sends a 10 KB system-information beacon.

T1497.001System ChecksEvidence2

The CurlRAT watchdog checks for /usr/lib/libvirtlog.so.0 and aborts after a delay if the file is absent.

Collection

1 technique

T1560Archive Collected DataEvidence1

SSH-keylogger output is encrypted with a substitution cipher; CurlRAT encrypts and Base64-encodes outbound data.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

Output returns on the raw socket under a standard HTTP/1.0 200 OK header, which is what makes the exchange look like ordinary web traffic.

T1102Web ServiceEvidence1

CurlRAT uses img.monderhouse.space and img.darklights.store as fallback or backup configuration hosts.

T1132.001Standard EncodingEvidence1

CurlRAT Base64-encodes feedback-XOR-encrypted C2 payloads; ted uses rolling XOR for pipe-protocol data.

T1568Dynamic ResolutionEvidence1

CurlRAT derives an MD5 victim ID from the hostname, IP address, hardware/OS UUID, and cron version, then uses it in C2 headers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

CurlRAT streams command output over its C2 channel, while captured credentials and web-session data are staged for operator collection.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Sep 4, 2026

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

rapid7 blogNews

Sep 4, 2026

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.