New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
A previously undocumented Linux toolkit, dubbed ‘ted,’ has been discovered embedded within trojanized HAProxy load balancers used by two South Korean organizations. Developed by North Korean state-sponsored actors (likely through APT37, alongside Lazarus and Kimsuky), the tool intercepts web traffic, serves altered pages, and steals credentials. The attackers use a complex delivery model, including compromised websites and a RAT, to gain access. Rapid7 found the toolkit in HAProxy 2.8.12, a version with numerous known vulnerabilities. Rapid7 recommends independent network correlation, memory behavioral analysis, and binary integrity checks to mitigate the threat.
A previously undocumented Linux toolkit, named ‘ted,’ has been found embedded within trojanized HAProxy load balancers used by two South Korean organizations – one in the automotive sector and the other in media. Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors, specifically linking it to APT37, alongside Lazarus and Kimsuky. The tool intercepts web traffic and serves altered pages to selected visitors, effectively creating a watering hole attack.
Rapid7 discovered that ‘ted’ requires code execution on the host and the ability to replace the running binary. It decrements HAProxy’s live connection counters, dropping connections from the load balancer’s statistics, and writes command bodies to a named pipe under /tmp. The implant rewrites content types and lengths, forces the response status to 200, and deletes the Accept-Ranges header to prevent clients from requesting byte ranges. The tool also encrypts captured plaintext passwords and writes them to a fixed path.
The attackers use a complex delivery model, including compromised Korean websites and a RAT called curlRAT, which beacons every 12 hours by default, shortening to 30 seconds when the operator sets a flag. The RAT aborts unless it finds a marker file indicating a virtualized host. Rapid7 found the same code in trojanized agetty, atd, and polkitd binaries.
The toolkit is designed to exploit HAProxy 2.8.12, a version with numerous known vulnerabilities (529 reported bugs). The attackers replace the binary rather than exploit a flaw in it. The tool reads HAProxy’s internal structures at offsets fixed to that release, and a recompiled HAProxy reports the same version string as a clean build.
Rapid7 linked the delivery model to Operation SyncHole, where visitors to South Korean online media sites were filtered by a server-side script and redirected. Kaspersky researchers Sojun Ryu and Vasily Berdnikov assessed “with medium confidence” that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper.
The attribution passage draws on three separate North Korean clusters: APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Mandiant's 2023 assessment of North Korean cyber structure recorded shared tooling and overlapping targeting across those clusters. Rapid7 recommends independent network correlation, memory behavioral analysis and binary integrity checks to mitigate the threat. The Hacker News confirmed on September 4 that all six domains resolve to NXDOMAIN, useful for historical log review, not live traffic blocking. Six further domains sit in the same two maltrail entries but not in Rapid7’s list.