Trojanized HAProxy in South Korea: the ted backdoor intercepts traffic and conceals remote control

Rapid7 Labs discovered a previously undocumented Linux toolkit embedded in modified builds of HAProxy 2.8.12 at two South Korean organizations in the automotive and media sectors. The malware, named ted based on its symbols and debug strings, can selectively manipulate HTTP responses, execute commands, and steal credentials.

This is not an HAProxy vulnerability. The attackers must first gain code execution on the server and replace the legitimate load balancer binary. The implant therefore indicates a deeper system compromise, although the initial access vector remains unknown.

Rapid7 assesses, with medium confidence, that the operation was conducted by North Korean state-sponsored actors. Its technical traces overlap with infrastructure and operating methods associated with APT37, Lazarus, and Kimsuky, but do not support a more precise attribution.

The compromised builds rely on HAProxy 2.8.12

Both victims were running HAProxy 2.8.12, released on November 8, 2024. ted does not simply run alongside the software: the HAProxy binary is replaced with a trojanized build containing the implant code itself.

The malware accesses the program’s internal structures using fixed offsets specific to the observed release. Rapid7 has not determined whether other 2.8-series builds are compatible with the same code.

This constraint may provide a useful investigative lead, but it does not lessen the severity of the intrusion. A different version might require the attackers to recompile the malware or adjust its offsets, although there is no evidence on this point.

The current release in the branch is HAProxy 2.8.28, published on August 27, 2026, sixteen point releases after the compromised version. The project tracker lists 529 bugs present in 2.8.12 that have since been fixed in the 2.8 branch, including one critical issue and 16 classified as major.

Updating remains necessary, but it is not a remediation measure by itself. ted does not exploit any of these bugs, and an already infected system may retain other malicious components even after HAProxy is replaced. In addition, a recompiled build may display the same version string as the authentic binary.

The reported version alone proves nothing.

Because no product vulnerability was identified, there is no CVE identifier to address in this case. Nor is there any question of adding the issue to CISA’s KEV Catalog: the attack requires a prior compromise and replacement of the software.

The injection targets only selected visitors

ted performs four checks before modifying an HTTP response. The request must contain a User-Agent, while the URL and Referer must match patterns configured by the operators.

The client’s origin is also verified. Its address must be included on an allowlist, either through an exact match or a /24 network match, unless the request contains a particular key in the Accept-Language field.

The latter acts as a passphrase, allowing the operator to bypass the IP filter entirely. It can therefore be used to test the implant or reach it from addresses that were not preconfigured.

When all conditions are met, the malware replaces the content intended for the visitor. During the process, it rewrites the response type and length, forces the HTTP status to 200, and removes the Accept-Ranges header.

Removing Accept-Ranges prevents the client from requesting specific portions of the file. This reduces the likelihood that differences in response size or behavior will expose the alteration.

Selectivity is central to the operation. Regular users, scanners, and automated systems may receive legitimate content, while only selected targets see the manipulated page. An occasional check of the site may therefore reveal nothing.

The C2 channel disappears from the load balancer’s statistics

A request to a specific image path activates command-and-control mode. The connection terminates directly on the compromised HAProxy and does not reach the backend servers.

To conceal it, ted decrements the load balancer’s active-connection counters. The exchange therefore does not appear in HAProxy’s native statistics, while the backends cannot log it because they never receive the request.

The command body is written to a named pipe located under /tmp. Once used, the request channel is cleared. Command output is returned to the operator over the raw socket, preceded by a standard HTTP/1.0 200 OK header.

Through this channel, the attackers can:

• send beacons;
• upload and download files;
• execute shell commands;
• replace ted’s configuration.

The result is a C2 channel disguised as web traffic and hidden from the service’s primary telemetry sources. Detecting it therefore requires comparing HAProxy data with independent sources, such as network flows captured externally to the server.

Persistence, trace removal, and password theft

The toolkit includes a stager that begins installation only if it finds HAProxy or cron already running. It also checks that it has root privileges before proceeding.

Once active, it overwrites the legitimate crond binary and gives the replacement the creation timestamp associated with /usr/bin/ssh. This manipulation is intended to make the introduction of a new executable less apparent.

ted also tampers with traces left during installation. In root’s Bash history, it removes the terms tmp, wget, cron, and crond; the same words are removed from six system logs, including auth.log and audit/audit.log.

The absence of these strings therefore does not indicate that the activity never occurred. Time gaps, inconsistent entries, or discrepancies compared with centralized log copies may be more revealing than a simple text search.

Rapid7 also identified a trojanized sshd component capable of capturing plaintext passwords, encrypting them, and saving them to a fixed path. Similar code appeared in modified versions of agetty, atd, and polkitd.

The operation therefore extends beyond web-traffic manipulation. It includes persistence, remote control, credential collection, and tampering with multiple core system components.

The toolkit is also associated with curlRAT, a remote access trojan that normally beacons every 12 hours. An operator-controlled flag reduces the interval to 30 seconds. The malware stops executing if it cannot find a marker file confirming that the host is virtualized.

curlRAT should not be confused with CurlBack RAT, a separate family attributed to SideCopy, a Pakistan-linked group.

North Korean attribution remains inconclusive

The known victims are two South Korean organizations operating in the automotive and media sectors. It is not known when the compromises began or how the operators obtained initial access.

One possible lead involves an exposed Groupware portal. ENKI previously documented a compromise attributed to Kimsuky involving a Korean collaborative-software provider through a vulnerability in a mail server. However, there is no direct evidence that the same route was used in the cases analyzed by Rapid7.

The medium-confidence attribution combines different elements: domains associated with APT37, a distribution model resembling Lazarus activity, and a possible initial-access path linked to Kimsuky.

A 2023 Mandiant assessment described North Korean operations as characterized by tool sharing and overlapping targeting across clusters. These intersections help explain why the indicators may point toward multiple groups at the same time.

The method also resembles Operation SyncHole, in which visitors to South Korean news websites were filtered server-side and redirected. Kaspersky assessed with medium confidence that the destination might execute malicious code by exploiting a vulnerability in Cross EX.

In another operation, AhnLab and ENKI WhiteHat described a watering-hole campaign in July that relied on compromised South Korean websites and targeted the AnySign4PC signing client. The comparison indicates continuity in victim-selection techniques, not proof that the operations were conducted by the same actor.

Indicators to look for and response priorities

The on-disk indicators include:

• ~/cache/haproxy-1000.cache
• /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19
• /var/lib/snapd/g580
• /tmp/jasper-log

The published SHA-256 hashes are:

• 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558
• 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5

The six domains associated with the activity are:

• img.monderhouse[.]space
• img.smartnords[.]site
• img.darklights[.]store
• img.responsive.pstatic[.]autos
• img.socialteams[.]store
• img.worksongo[.]store

As of September 4, 2026, none resolved through Google Public DNS: queries for A and NS records returned NXDOMAIN. They are therefore most useful for retrospective analysis of DNS, proxy, firewall, and network-flow logs rather than for blocking current traffic.

Response efforts should begin by isolating the host and verifying binaries against copies obtained from trusted sources. The checks should cover not only HAProxy, but also crond, sshd, agetty, atd, and polkitd.

Teams should also look for anomalous named pipes in /tmp, changes to root’s history, selective log cleaning, and connections not reflected in HAProxy’s counters. Memory analysis may identify resident code or structures that do not belong in the affected processes.

Reinstalling only the load balancer is not sufficient. Because privileged components were involved and passwords may have been stolen, remediation should include rotating potentially exposed credentials and, when host integrity cannot be established, rebuilding the system from trusted sources.