Rapid7 Labs has uncovered a previously undocumented Linux toolkit that attackers compiled directly into trojanized HAProxy load balancer binaries at two South Korean organizations — one in the automotive sector, one in media. The implant, named Ted after debug strings found in the binary, intercepts incoming web traffic at the load balancer layer before any request reaches a backend server. Command-and-control traffic is erased from HAProxy’s own connection counters, so neither backend application logs nor the load balancer’s built-in statistics record the exchanges. To an operator monitoring standard network telemetry, the compromised appliance looks entirely normal.
The technique is notable because Ted is not a HAProxy vulnerability: installing it requires the attacker to already have code execution on the host and the ability to replace the running binary. Once installed, Ted functions as a full-featured remote access toolkit — the operator can beacon to it, upload and download files, run shell commands, and update the implant’s configuration, all over what looks like ordinary HTTP/1.0 traffic. A companion implant replaces the system cron daemon and a trojanized SSH daemon captures plaintext passwords. To cover tracks, the installer strips references to tmp, wget, cron, and crond from root’s bash history and six system logs including auth.log and audit.log. Rapid7 attributes the toolkit with medium confidence to North Korean state-sponsored actors, drawing on overlaps with APT37, Lazarus, and Kimsuky infrastructure, though the firm says more evidence is needed for a definitive call.