Rapid7 identified a previously undocumented Linux espionage toolkit targeting South Korean media and automotive organizations and attributed the activity with medium confidence to DPRK APT operators. The framework combines a modified HAProxy implant called ted backdoor with curlRAT, an SSH credential logger, a stager, and trojanized Linux daemons. It can execute commands, maintain reverse or PTY shells, steal credentials and session cookies, intercept decrypted web traffic, and inject payloads selectively while suppressing evidence in HAProxy and system logs. Infrastructure associated with APT37 and operational overlap with earlier APT37 and Lazarus watering-hole activity support the DPRK assessment, although Rapid7 did not make a definitive cluster-level attribution.