New Linux Backdoor “Ted” Hidden Inside Trojanized HAProxy Targets South Korean Organizations

Previously Undocumented Linux Toolkit Hijacks HAProxy Traffic and Delivers Targeted Web Content

A previously undocumented Linux malware toolkit has been discovered embedded inside trojanized HAProxy load balancer binaries used by two organizations in South Korea.

The toolkit, identified as “ted” based on debug strings found inside the malware, is capable of intercepting web traffic, communicating with attackers, executing commands, transferring files, and selectively modifying web pages delivered to visitors.

The affected organizations operate in the South Korean automotive and media sectors.

According to Rapid7 Labs, the activity has been attributed with medium confidence to North Korean state-sponsored threat actors. However, researchers noted that additional evidence is required before making a more definitive attribution.

Importantly, the activity is not the result of an HAProxy vulnerability.

The attackers first need code execution on the target system and sufficient privileges to replace the legitimate HAProxy binary with a malicious version.

How the Ted HAProxy Backdoor Works

The malware is embedded directly into a modified HAProxy binary.

Once deployed, the backdoor hooks into HAProxy's normal request-processing behavior and monitors incoming HTTP traffic.

The attackers can use specially crafted requests to activate different functions within the implant.

The backdoor provides operators with capabilities including:

  • Command-and-control communication
  • Remote shell command execution
  • File upload
  • File download
  • Configuration replacement
  • Targeted web-page modification
  • Network reconnaissance and beaconing

One of the most notable characteristics is that the malware attempts to hide its C2 traffic from both backend systems and HAProxy monitoring.

Stealthy Command-and-Control Communication

Rapid7 found that a specific image request path can place the HAProxy implant into C2 mode.

When activated, the malware:

  1. Detects the specially crafted HTTP request.
  2. Decrements HAProxy's live connection counters.
  3. Writes the request body to a named pipe under /tmp.
  4. Prevents the request from reaching the backend server.
  5. Removes the request data from the normal processing path.
  6. Executes the supplied command.
  7. Returns the command output directly through the HTTP connection.

The response is formatted using a standard:

HTTP/1.0 200 OK

This allows the C2 exchange to resemble ordinary web traffic.

Because the request does not reach the backend application, backend server logs may not contain evidence of the communication.

The manipulation of HAProxy's connection counters also prevents the activity from appearing normally in HAProxy statistics.

Targeted Web Page Manipulation

The ted implant does not modify every visitor's traffic.

Instead, it performs multiple checks before delivering altered content.

A request must satisfy specific conditions involving:

  • User-Agent information
  • URL patterns
  • HTTP Referer patterns
  • Client IP address
  • Operator-controlled filtering rules

The client IP is checked both exactly and at the /24 network level.

The attackers can also bypass IP filtering by supplying a specific operator-controlled value through the Accept-Language header.

Only visitors who satisfy the required conditions receive modified content.

How the Malware Alters HTTP Responses

Once a target has been selected, the malware modifies the outgoing HTTP response.

The implant can:

  • Rewrite the content type
  • Modify the content length
  • Force the HTTP status code to 200
  • Remove the Accept-Ranges header

Removing Accept-Ranges is particularly interesting because it prevents clients from requesting partial byte ranges that could reveal inconsistencies in the modified response size.

This helps the altered content appear more like a legitimate server response.

Linux Persistence and System Manipulation

Rapid7 also identified additional components associated with the toolkit.

The stager checks whether HAProxy or cron is running before deploying its components and verifies that it has root privileges.

The malware was observed overwriting the legitimate crond binary.

It also attempts to make the malicious replacement appear legitimate by setting its creation timestamp to match /usr/bin/ssh.

The toolkit further attempts to remove evidence by deleting specific keywords from root's Bash history and modifying several system logs.

The keywords include:

  • tmp
  • wget
  • cron
  • crond

Logs targeted by the malware include authentication and auditing records such as auth.log and audit/audit.log.

Trojanized SSH Server Captures Credentials

Rapid7 discovered a modified sshd component within the same toolkit.

The trojanized SSH daemon is capable of capturing plaintext passwords.

The captured credentials are encrypted and stored at a predetermined location on the system.

This provides attackers with another mechanism for collecting authentication information and potentially expanding access within the compromised environment.

Additional Trojanized Linux Binaries

The researchers found related malicious code inside multiple legitimate Linux binaries, including:

  • agetty
  • atd
  • polkitd
  • sshd
  • crond
  • HAProxy

This indicates that the toolkit is designed to blend into legitimate system processes and maintain access through multiple components.

curlRAT Remote Access Trojan

The campaign also includes a remote access trojan that Rapid7 refers to as curlRAT.

The malware communicates with its C2 infrastructure every 12 hours by default.

When instructed by the operator, the beacon interval can be reduced to approximately 30 seconds.

Interestingly, curlRAT performs an environment check before continuing execution.

The malware looks for an indicator showing that the system is virtualized and terminates if the expected marker is not found.

Rapid7 emphasized that this curlRAT is different from another malware family called CurlBack RAT, which has previously been associated with the Pakistan-linked SideCopy threat group.

Possible Initial Access Through Korean Groupware

Rapid7 could not determine exactly how the attackers initially compromised the two organizations.

Researchers proposed that an exposed South Korean enterprise groupware platform may have been involved.

This hypothesis is based partly on previous ENKI research documenting attacks against a Korean groupware vendor.

However, Rapid7 stressed that the available evidence is insufficient to establish a definitive initial-access mechanism or attack timeline.

Possible North Korean Attribution

Rapid7 assessed the activity with medium confidence as potentially connected to North Korean state-sponsored operations.

The attribution is complicated because evidence points toward multiple North Korean threat clusters and previously observed techniques.

The research references infrastructure associated with:

  • APT37
  • Lazarus
  • Kimsuky

Rapid7 also compared the activity to previous South Korean watering-hole campaigns in which attackers selectively redirected visitors from compromised websites.

Researchers emphasized that overlapping tooling, infrastructure and targeting across North Korean groups can make precise attribution difficult.

HAProxy Version Used by the Victims

Both identified victims were running:

HAProxy 2.8.12

That version was released in November 2024.

The malware interacts directly with HAProxy's internal structures using offsets associated with that specific build.

This means the implant is closely tied to the HAProxy implementation rather than being a generic web-server backdoor.

The current HAProxy 2.8 branch has received numerous subsequent updates.

However, simply upgrading HAProxy does not remove an existing compromise, because the observed attack involves replacing the legitimate HAProxy binary with a trojanized one.

Organizations must therefore perform host-level integrity and behavioral investigations in addition to software upgrades.

Indicators of Compromise

Rapid7 published the following indicators associated with the campaign.

C2 Domains

  • img.monderhouse[.]space
  • img.smartnords[.]site
  • img.darklights[.]store
  • img.responsive.pstatic[.]autos
  • img.socialteams[.]store
  • img.worksongo[.]store

Suspicious Files

  • ~/cache/haproxy-1000.cache
  • /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19
  • /var/lib/snapd/g580
  • /tmp/jasper-log

SHA-256 Hashes

  • 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558
  • 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5

The reported domains should primarily be considered useful for historical threat hunting and log analysis, as the domains were reported as no longer resolving.

What Makes This Attack Particularly Dangerous?

The most concerning aspect of the campaign is that the attacker is compromising a load balancer positioned in front of web applications.

Traditional investigations may focus heavily on:

  • Web servers
  • Application servers
  • Backend logs
  • Database systems
  • Endpoint malware

However, a compromised HAProxy instance can sit in front of these systems and manipulate traffic before it reaches the backend.

This creates a significant visibility gap.

The attackers can potentially control what selected users see while keeping the backend application unaware of the malicious requests.

Why Backend Logs May Not Detect the Attack

In a traditional web attack, malicious requests usually reach the application server and generate corresponding logs.

The ted implant changes this behavior.

Its C2 requests can terminate directly at the load balancer.

As a result:

Client → Trojanized HAProxy → Attacker

instead of:

Client → HAProxy → Backend Application

This means defenders relying exclusively on backend web logs may miss the malicious communication.

Organizations using HAProxy should consider the following steps when investigating potential compromise:

1. Verify HAProxy Binary Integrity

Compare the running HAProxy binary against a known-good package or trusted build.

Do not rely solely on the version string because a trojanized binary can report the expected version.

2. Investigate Running Processes

Look for unexpected processes, suspicious parent-child relationships, and processes running with root privileges.

3. Review Cron and System Binaries

Inspect the integrity of:

  • crond
  • sshd
  • agetty
  • atd
  • polkitd

Unexpected modifications should be investigated immediately.

4. Analyze HAProxy Traffic

Look for unusual requests involving:

  • Image paths
  • Unexpected User-Agent values
  • Abnormal Referer patterns
  • Suspicious Accept-Language headers
  • Unusual HTTP/1.0 responses
  • Unexpected status-code manipulation

5. Review Historical Logs

Search historical DNS, proxy, firewall and HTTP logs for the listed C2 domains.

Because the infrastructure may no longer resolve, historical telemetry can be more valuable than simply attempting to block the domains.

6. Inspect File System Artifacts

Search for the suspicious paths and hashes published by Rapid7.

Also investigate unexpected files under:

  • /tmp
  • /var/lib/sshd
  • /var/lib/snapd
  • User cache directories

7. Investigate Root-Level Persistence

Review cron jobs, system services, startup scripts, modified binaries and authentication components.

8. Perform Memory and Network Analysis

Rapid7 recommends combining:

  • Network correlation
  • Memory behavioral analysis
  • Binary integrity verification

A host that shows suspicious HAProxy behavior should be treated as potentially compromised even when the installed package version appears legitimate.

Key Takeaways

The ted Linux backdoor demonstrates how attackers can compromise security infrastructure rather than directly targeting an application server.

By embedding malware inside HAProxy, attackers can potentially:

  • Intercept web traffic
  • Deliver targeted malicious content
  • Execute remote commands
  • Transfer files
  • Hide C2 requests from backend systems
  • Manipulate load-balancer statistics
  • Capture credentials
  • Maintain persistence through modified Linux binaries

The campaign has been linked with medium confidence to North Korean state-sponsored activity, but Rapid7 says additional evidence is required for definitive attribution.

The incident also highlights an important defensive lesson:

A trusted software version number does not guarantee binary integrity.

Organizations operating internet-facing HAProxy infrastructure should combine package verification, binary integrity monitoring, endpoint investigation, network telemetry and behavioral analysis when assessing potential compromise.