🦠 A trojanized HAProxy wiretap uncovered in South Korea
A previously undocumented Linux toolkit, dubbed Ted, has been found compiled directly into the HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. According to researchers at Rapid7, the implant points to a targeted and highly stealthy operation.
7️⃣ How the compromise works
Ted is not a HAProxy vulnerability. Installing it requires code execution on the target host and the ability to swap the running binary for a trojanized build, compiled directly into the victim's own installation, in this case version 2.8.12. This deep integration lets the implant abuse the load balancer's native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic, while legitimate load balancing keeps working normally.
The real danger lies in the position this software occupies: the load balancer is the SSL/TLS termination point, which means it decrypts every HTTPS connection before forwarding traffic to backend servers. Once the backdoor was live, the attackers could read, modify, and log every decrypted session passing through it without ever touching a backend server.
🧍♂️ Why it stays invisible
Evasion was baked into Ted's design from the ground up. Commands from the attacker's infrastructure arrived disguised as requests for a specific image path, terminating at the load balancer without ever reaching a backend server. The implant then decremented HAProxy's live connection counters, effectively erasing the connection from the load balancer's own statistics. As a result, nothing showed up in monitoring dashboards, backend logs, or load balancer statistics.
Before serving a manipulated page, the implant filtered requests using several criteria, including User-Agent, URL, referrer patterns, and client IP addresses, delivering malicious content only to chosen visitors in a watering-hole style loop. It also manipulated HTTP headers to hide any evidence of the tampered page from the visitors themselves.
⭕️ Attribution and the wider toolkit
Rapid7 Labs attributed the framework with medium confidence to North Korean state-sponsored actors, placing the two victims in South Korea's automotive and media sectors. Keep in mind that attribution at this confidence level should be treated as indicative rather than definitive. Beyond the backdoor itself, the campaign included trojanized versions of crond, agetty, atd, sshd, and polkitd.
The trojanized SSH daemon worked as a keylogger for harvesting passwords, while a companion remote access trojan, curlRAT, enabled data exfiltration, remote command execution, and script injection from internal servers. Evidence suggests the attackers may have gained their initial foothold through an exposed Groupware portal, a popular Korean enterprise collaboration platform.
😊 If you enjoyed the article share it with your friends and follow us.
#CyberSecurity #TedBackdoor #HAProxy #ThreatIntelligence #Espionage
@PrivacyNotACrime 🗽 ⌨️ Chat
