North Korean Actors Deploy 'Ted' Backdoor in Trojanized HAProxy Builds

State-sponsored attackers have deployed a stealthy Linux toolkit known as 'ted' by compiling it directly into trojanized HAProxy load balancers. The implant was discovered at two South Korean organizations operating in the media and automotive sectors, where it was used to manipulate web traffic and maintain a persistent command-and-control (C2) channel.

The 'ted' implant allows attackers to intercept web traffic and serve altered pages to specific visitors while facilitating data exfiltration and remote command execution. To remain undetected, the malware actively erases its activity from HAProxy's backend logs and connection counters. According to research from Rapid7 Labs, the implant specifically targets HAProxy version 2.8.12, utilizing fixed offsets to read the software's internal structures.

A Pattern of Sophistication

This operation is not the result of a vulnerability within HAProxy itself; rather, it requires the attackers to already have code execution privileges on the host to replace the legitimate binary with a trojanized version. The toolkit is extensive, featuring other compromised system binaries including agetty, atd, polkitd, and sshd—the latter of which was modified to encrypt plaintext passwords. The attackers also deployed a companion remote access trojan (RAT) known as 'curlRAT'.

Rapid7 Labs attributed the toolkit to North Korean state-sponsored actors with medium confidence. This assessment is based on infrastructure linked to APT37 and delivery models that mirror those used by the Lazarus group. While the attribution is strong, Rapid7 noted that further evidence is necessary to make a more definitive assessment.

Infrastructure Under Siege

This campaign mirrors previous North Korean operations, such as 'Operation SyncHole,' which similarly used server-side scripts to redirect users to malicious content. The high level of sophistication is further evidenced by the attackers' efforts to clean bash histories and system logs to ensure long-term persistence.

This represents a critical threat to network security because the backdoor resides within the load balancer—the primary tool used to manage and secure incoming traffic. By bypassing standard monitoring alerts and manipulating internal counters, the actors can maintain a nearly invisible presence. This allows them to intercept sensitive data and target high-value individuals without triggering the security alarms that typically flag unauthorized traffic or system changes.

Future Outlook

Security teams are now tasked with verifying the integrity of core system binaries, as the use of trojanized versions of sshd and HAProxy demonstrates a move toward deeper system integration. Analysts will continue to monitor for further links between the 'ted' toolkit and known DPRK infrastructure to refine attribution and identify other potential victims across the region.