'Ted' Backdoor Hides Inside Trojanized HAProxy Builds to Intercept Web Traffic

A Backdoor Built Into the Load Balancer

Researchers at Rapid7 Labs have documented a previously undocumented Linux toolkit, internally named Ted by its operators, compiled directly into trojanized HAProxy load-balancer binaries. Rapid7 found the implant running inside the infrastructure of two South Korean organizations, in the automotive and media sectors, where it intercepted and selectively altered web traffic passing through the compromised load balancers.

Unlike a typical exploit, Ted doesn't rely on a HAProxy vulnerability. Deploying it requires an attacker to already have code execution on the host and the ability to replace the running binary — meaning this is a post-compromise persistence and traffic-manipulation tool, not an initial-access exploit. The implant reads HAProxy's internal memory structures at offsets hardcoded for version 2.8.12 (released November 8, 2024), the exact version running on both known victims.

How It Works

Command-and-control channel: Requests to specific, attacker-defined image paths on the load balancer trigger C2 mode. To avoid leaving evidence in HAProxy's own statistics, the implant decrements HAProxy's internal connection counters after handling a C2 request, effectively erasing the interaction from the load balancer's own metrics. Command payloads are written to named pipes under /tmp, and responses are wrapped in a standard HTTP/1.0 200 OK header to blend in with normal traffic.

Selective content modification: Ted can serve altered pages to hand-picked visitors, gated either by IP address (checked at both the /24 CIDR block and exact-match levels) or by an operator key embedded in the Accept-Language header — allowing the attackers to target specific visitors without affecting the site for everyone else.

Remote operator functions: Through the hidden channel, operators can beacon, upload and download files, execute shell commands, and rewrite HAProxy's configuration.

Companion Malware and Persistence

Alongside Ted, Rapid7 identified a companion remote access trojan called curlRAT, which beacons to its operators every 12 hours by default, dropping to 30-second intervals when specific operator flags are set — presumably during active operations. The broader toolkit also includes trojanized versions of standard Linux binaries — sshd, agetty, atd, and polkitd — repurposed for credential capture and long-term persistence.

Attribution

Rapid7 attributed the toolkit to North Korean state-sponsored actors with medium confidence, drawing technical and infrastructure overlaps with three known clusters: APT37, Lazarus, and Kimsuky. Researchers hypothesize the initial compromise came through an exposed Groupware portal vulnerability, consistent with prior Kimsuky activity previously documented by ENKI research.

Indicators of Compromise

All six domains returned NXDOMAIN as of September 4, 2026. File paths and SHA-256 hashes for the trojanized binaries were included in Rapid7's original report.

Why This Matters

Both confirmed victims were still running HAProxy 2.8.12, an outdated branch release. The current 2.8 branch release, 2.8.28 (August 27, 2026), has shipped 529 bug fixes since 2.8.12 — including one critical and 16 major vulnerabilities. Ted itself doesn't exploit HAProxy directly, but it demonstrates how attackers with a post-compromise foothold can weaponize a stale, unpatched infrastructure component as a long-term, low-visibility traffic-interception platform — one that actively hides its own presence from the very tool's operational statistics.

Rapid7 noted it currently lacks sufficient evidence to establish a precise attack timeline for either victim.

Recommended Actions

1. Upgrade HAProxy off the 2.8.12 build and onto a current, patched release.
2. Verify binary integrity of HAProxy and other critical infrastructure binaries (sshd, agetty, atd, polkitd) against known-good hashes; do not trust a running binary simply because the service is healthy.
3. Monitor for connection-counter anomalies in HAProxy statistics that don't reconcile with actual observed traffic — a potential sign of Ted-style counter manipulation.
4. Audit exposed Groupware and web-facing portals for the vulnerability class believed to have enabled initial access in this campaign.
5. Block the published IOC domains and hunt for historical DNS resolution to them in logs, even though they currently return NXDOMAIN.

Sources

• The Hacker News — New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic