Rapid7 Labs has documented a stealthy Linux toolkit compiled directly into trojanized HAProxy load balancers at two South Korean organizations, where it intercepted web traffic and served doctored pages to selected visitors. Researchers named the implant Ted after debug strings left in the binary and attributed it with medium confidence to North Korean state-sponsored actors. The victims operate in the country’s automotive and media sectors.
Ted is not exploiting a HAProxy vulnerability. Planting it requires existing code execution on the host and the ability to replace the running load balancer binary, meaning attackers already held deep access before the backdoor went in.
The implant’s command channel is engineered to stay invisible. A request for one specific image path flips the filter into command-and-control mode, and those requests never reach a backend server. Ted decrements HAProxy’s live connection counters so the exchange vanishes from the load balancer’s own statistics. Commands land in a named pipe under /tmp, output returns over the raw socket under a standard HTTP/1.0 200 OK header, and operators can beacon, transfer files, run shell commands, and swap the implant’s configuration.
Only traffic passing four checks receives a modified page: a matching User-Agent, URL and referer rules that both fit, and either a whitelisted client address checked exactly and again at the /24 level or an operator key carried in the Accept-Language header that overrides the address filter.
Rapid7 said further evidence is needed before a more definitive assessment. Defenders running HAProxy should verify binary integrity against vendor checksums and watch for odd image-path requests that turn the filter into a covert channel.
