North Korean Hackers Deploy Ted Backdoor in South Korean HAProxy Servers

September 4, 2026 at 07:51 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A previously undocumented Linux toolkit named ted was found compiled into trojanized HAProxy load balancers at two South Korean organizations, where it intercepted web traffic and served altered pages. Rapid7 Labs attributed the implant with medium confidence to North Korean state-sponsored actors and identified victims in the automotive and media sectors. The backdoor hides command-and-control traffic from HAProxy's own connection counters, leaving no trace in backend logs.

Key Facts

The implant is named ted based on debug strings left in the binary, and it is not a vulnerability in HAProxy itself.
Installing the backdoor requires code execution on the host and the ability to replace the running HAProxy binary.
Command-and-control requests never reach a backend server and are erased from HAProxy's connection counters, so neither backend logs nor load balancer statistics record them.
The operator can beacon, upload and download files, run shell commands, and replace the implant's configuration through a channel that mimics ordinary HTTP traffic.
Only requests that pass four checks—including a matching User-Agent, URL, referer, and either whitelist membership or an operator key in the Accept-Language header—receive a modified page.

Implant Mechanics

A request for one specific image path puts the filter into command-and-control mode, according to Rapid7's report published Friday. The implant decrements HAProxy's live connection counters, dropping the connection from the load balancer's statistics, and writes the command body to a named pipe under /tmp. Zeroing the request channel afterwards leaves nothing to forward, and the command terminates at the load balancer. Output returns on the raw socket under a standard HTTP/1.0 200 OK header, making the exchange look like ordinary web traffic. The implant rewrites the content type and length on the way out, forces the response status to 200, and deletes the Accept-Ranges header so a client cannot request byte ranges and notice the size change.

Attribution and Access

Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors and put the two victims in South Korea's automotive and media sectors. Rapid7 said its evidence was not enough to establish a timeline or determine how the attackers first got in. Its hypothesis that they came in through an exposed Groupware portal rests on ENKI research documenting Kimsuky compromising a groupware vendor through a mail server flaw. The stager deploys only where HAProxy or cron is already running, and it verifies root before dropping anything. It overwrites the legitimate crond binary and gives the replacement the creation timestamp of /usr/bin/ssh, then strips the keywords tmp, wget, cron and crond from root's bash history and from six system logs, including auth.log and audit/audit.log.

Credential Theft Component

A trojanized sshd in the same toolkit encrypts captured plaintext passwords and writes them to a fixed path. Rapid7 said further evidence is necessary to make a more definitive assessment.