A previously undocumented Linux toolkit named 'Ted' has been discovered compiled directly into trojanized HAProxy load balancers targeting two South Korean organizations. The implant intercepts web traffic and serves altered pages to selected visitors, functioning as a stealthy backdoor. The name 'ted' was found in debug strings left in the binary by the attackers. This is not a vulnerability in HAProxy itself; rather, the attackers required prior code execution on the host to insert the malicious implant. The toolkit represents a sophisticated supply-chain-style attack against organizations' own infrastructure builds. The incident highlights risks of insider-style or post-compromise tampering with critical network load balancing software.
The 'ted' backdoor is a previously undocumented Linux toolkit compiled directly into trojanized HAProxy load balancer binaries targeting two South Korean organizations (automotive and media sectors). The implant intercepts web traffic and serves altered pages to selected visitors. It is not a HAProxy vulnerability; deployment requires prior code execution on the host and the ability to replace the running binary. A specific image path request triggers C2 mode; the implant decrements HAProxy's live connection counters to hide the connection from statistics, writes the command body to a named pipe under /tmp, and zeroes the request channel so nothing is forwarded to backend servers — making C2 traffic invisible to backend logs. Output returns over a raw socket under a standard HTTP/1.0 200 OK header to blend in as normal web traffic. Operators can beacon, upload/download files, run shell commands, and update the implant's configuration. Modified pages are only served to requests passing four checks: matching User-Agent, URL and referer patterns, and either IP whitelist membership (exact and /24 subnet) or an operator key in the Accept-Language header. The implant rewrites content type, length, and response status (forces 200), and deletes Accept-Ranges headers to prevent clients from detecting size changes. The stager deploys only where HAProxy or cron is running, verifies root access, overwrites the legitimate crond binary (timestamped to match /usr/bin/ssh), and strips keywords (tmp, wget, cron, crond) from root's bash history and six system logs including auth.log and audit/audit.log. A trojanized sshd captures and encrypts plaintext passwords, writing them to a fixed path. The same code was found in trojanized agetty, atd, and polkitd binaries. A companion RAT called curlRAT beacons every 12 hours by default (dropping to 30-second intervals when operator sets a flag) and aborts unless it finds a marker file indicating a virtualized host. Both victims ran HAProxy 2.8.12. The implant reads HAProxy's internal structures at offsets fixed to that specific release. Attribution with medium confidence to North Korean state-sponsored actors draws on APT37 (domain list), Lazarus (delivery model similar to Operation SyncHole watering-hole), and Kimsuky (initial access via exposed Groupware portal hypothesis).
1. Perform independent network correlation to identify suspicious traffic patterns consistent with the ted backdoor's C2 communication disguised as normal HTTP traffic. 2. Conduct memory behavioral analysis to detect anomalous activity from HAProxy or other potentially trojanized binaries. 3. Perform binary integrity checks on HAProxy and system binaries (crond, sshd, agetty, atd, polkitd) — note that a recompiled HAProxy reports the same version string as a clean build, so cryptographic hashing against known-good builds is necessary. 4. Review historical logs for the listed IOC domains, even though they currently return NXDOMAIN. 5. Inspect /tmp for named pipes or the jasper-log file, and check for the listed file paths (/var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, /var/lib/snapd/g580, ~/cache/haproxy-1000.cache). 6. Audit root bash history and system logs (auth.log, audit/audit.log) for signs of tampering or keyword stripping. 7. Check for unexplained modification timestamps on system binaries (e.g., crond timestamped to match /usr/bin/ssh). 8. Upgrade HAProxy from 2.8.12 to the latest release (2.8.28 or newer) to remediate the 529 known bugs including 1 critical and 16 major — note this does not clean an already-compromised host. 9. If compromise is suspected, full host reimaging is recommended rather than binary replacement alone. 10. Monitor for curlRAT beaconing patterns (12-hour intervals, dropping to 30 seconds) and check for virtualization marker files. 11. Review access to exposed Groupware portals and mail server configurations to close potential initial access vectors associated with Kimsuky TTPs.
img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store, img.worksongo[.]store, ~/cache/haproxy-1000.cache, /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, /var/lib/snapd/g580, /tmp/jasper-log, 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558, 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5
