North Korean APTs targeted South Korean automotive and media firms using a stealthy HAProxy backdoor called Ted to intercept traffic and execute commands.

The integrity of the software supply chain is often discussed in terms of third-party libraries or compromised updates. However, a recent discovery by Rapid7 Labs reveals a more invasive approach: the direct trojanization of a victim's own binaries. A sophisticated Linux toolkit, internally dubbed ted, has been identified operating within the HAProxy load balancers of two South Korean organizations. Unlike a standard vulnerability that can be patched, this implant is compiled directly into the running version of the software, turning a critical piece of network infrastructure into a silent espionage tool.

A stealthy integration within HAProxy

The Ted backdoor does not exploit a flaw in HAProxy. Instead, it requires the attacker to have already achieved code execution on the host system with sufficient privileges to replace the legitimate binary. Once the trojanized version is in place, the implant leverages the native filter API, internal memory pools, and the event scheduler of the load balancer. This allows the malware to intercept web traffic and inject malicious scripts while the genuine load balancing functions continue to operate without interruption.

The level of stealth is significant. When the backdoor receives a command-and-control (C2) request—triggered by a specific image path—it enters a specialized mode. To avoid detection by system administrators monitoring performance, the implant decrements HAProxy's live connection counters. This effectively drops the connection from the load balancer's statistics, ensuring that neither the backend logs nor the internal statistics record the malicious exchange. The command body is then written to a named pipe under /tmp, and the request channel is zeroed out so nothing is forwarded to the backend server.

The mechanics of targeted traffic manipulation

The operators of the Ted backdoor are not interested in broad attacks but in surgical precision. The toolkit employs a rigorous four-step verification process to decide whether to serve a modified page to a visitor. First, the request must carry a specific User-Agent. Second, it must match predefined URL and referer patterns. Third, the client's IP address must either be on a whitelist (checked at both the exact address and the /24 subnet level) or provide a specific operator key within the Accept-Language header to override address filtering.

Once these conditions are met, the implant rewrites the content type and length of the outgoing data and forces a 200 OK response status. To prevent a sophisticated user or automated tool from noticing a change in file size, the malware deletes the Accept-Ranges header. This prevents the client from requesting byte ranges, which would otherwise reveal that the page size has been altered by the injection of malicious scripts.

Beyond the load balancer: A comprehensive toolkit

While the Ted implant is the most striking component, it is part of a broader framework designed for long-term persistence and surveillance. Rapid7 identified several other trojanized system binaries, including sshd, agetty, atd, polkitd, and crond. The trojanized sshd, for instance, is designed to capture plaintext passwords, encrypt them, and write them to a fixed path on the system.

The toolkit also includes a remote access trojan (RAT) referred to as curlRAT. This component maintains a watchdog thread that specifically monitors the health of the HAProxy process and reports its status back to the C2 infrastructure. To further hide its tracks, the stager used in the deployment process overwrites the legitimate crond binary and manipulates its creation timestamp to match that of /usr/bin/ssh. It also scrubs keywords such as wget, cron, and tmp from the root user's bash history and various system logs, including auth.log and audit.log.

Attribution and the South Korean angle

Rapid7 Labs has attributed this activity to North Korean state-sponsored actors with medium confidence. This assessment is based on several factors, including the targeting of the South Korean automotive and media sectors—industries of high strategic value for espionage. Furthermore, the C2 infrastructure identified in the campaign has been associated with APT37 by threat intelligence platforms like ThreatFox and maltrail.

Regarding the initial entry point, researchers hypothesize that the attackers may have exploited vulnerabilities in Groupware portals. These portals are a common class of enterprise collaboration software used extensively in South Korea. This theory aligns with previous reports regarding the group Kimsuky, which has a history of compromising groupware vendors through mail server flaws to gain a foothold in target networks. The earliest evidence of the toolkit on VirusTotal dates back to mid-2025, suggesting a campaign that has been active and undetected for a considerable period.

The ted backdoor could be part of a broader framework covering nginx backdoor as well, suggesting that these actors are developing a library of implants for various high-traffic web servers.

Technical summary of the Ted framework

The following details outline the operational capabilities and indicators associated with the discovered toolkit:

• C2 Communication: Uses raw sockets with HTTP/1.0 200 OK headers to blend in with normal web traffic.
• Capabilities: Remote shell command execution, file upload/download, and configuration replacement.
• Persistence: Trojanized system binaries (sshd, crond) and a dedicated watchdog RAT.
• Detection Evasion: Manual decrementing of HAProxy connection counters and log scrubbing of bash history.
• Targeting: Strict IP whitelisting and header verification to limit exposure to the general public.

Global implications for international enterprises

For businesses in the USA, UK, and other global markets, the Ted backdoor serves as a critical warning about the vulnerability of the Linux utility stack. While the current victims are concentrated in South Korea, the methodology—targeting the load balancer to intercept traffic before it even reaches the application server—is universally applicable. This bypasses many traditional Web Application Firewalls (WAFs) because the manipulation happens within the load balancer itself.

From a regulatory and risk perspective, companies operating under the UK GDPR or various US state laws (such as CCPA) must recognize that such an implant allows for the silent harvesting of session cookies and plaintext credentials. Because the attack erases its own traces in the connection statistics, traditional monitoring may fail to trigger alerts. Organizations should move toward File Integrity Monitoring (FIM) and strict binary verification. Relying on the assumption that a standard binary like HAProxy is secure is no longer sufficient; enterprises must implement checksum verification and ensure that only signed binaries are executed in production environments to mitigate the risk of state-sponsored trojanization.

FAQ

---

Sources: Thehackernews, Cyberwebspider, Rapid7 ·