Two South Korean organizations have been identified as being infected with a previously undocumented Linux backdoor embedded directly within custom versions of HAProxy load balancers. Based on debug strings found in the binary, Ted was able to intercept web traffic and deliver modified content to selected users.
The activity was attributed with medium confidence to North Korean state-sponsored threat actors by Rapid7 Labs. Affected organizations are members of South Korea’s automotive and media industries. As a result, Ted implant appears to have been designed to maintain access to compromised systems while remaining difficult to detect by routine monitoring.
The Ted implant did not result from a vulnerability in HAProxy.
An attacker must obtain code execution on the affected host in order to deploy the backdoor, which requires replacing the legitimate HAProxy binary with a modified version. As observed, the backdoor is bundled with HAProxy 2.8.12, enabling the malicious code to operate alongside the load balancer's legitimate functions.
As opposed to running as a separate suspicious process, Ted utilizes HAProxy’s filter API, memory pools, event scheduler and process management components.
It is possible for the implant to observe HTTP traffic while the server is performing normal load-balancing activities. It is possible to monitor high-value web requests, capture session cookies, and identify certain clients for traffic manipulation using the backdoor. Additionally, malicious scripts may be injected into pages delivered to targeted visitors.
The integration of this activity with an existing network component makes it difficult to identify the activity by conventional process or file-based monitoring mechanisms.
Additionally, Ted is equipped with a concealed command-and-control feature. By sending a request to the filter targeting specific image paths, the filter will be switched to C2 mode. This implant manages the command traffic within HAProxy rather than forwarded to a backend server, while removing the connection from HAProxy's live connection counter.
After writing the command data to /tmp, the request channel is cleared.
A load balancer terminates the connection, preventing the backend server from receiving a corresponding request. Therefore, neither backend logs nor HAProxy's normal connection statistics are able to provide a detailed account of C2 activity.
Rapid7 emphasized that additional evidence must be provided before definitively attribution can be made to North Korean operators.
This assessment is supported by the targeting of South Korean organisations, combined with the infrastructure and malware characteristics associated with activities linked to the DPRK.
In addition to the HAProxy implant, Rapid7 identified a more comprehensive toolkit. During the same operation, modified versions of crond, sshd, Agetty, Atd, and Pollkitd were also utilized, giving operators a number of ways to maintain access and collect data from compromised systems. Upon discovering the stager, it was discovered that the additional components were only deployed on systems that already contained HAProxy or cron.
The malicious replacement for crond was also crafted to closely replicate the legitimate system binary, including adopting a matching creation timestamp, prior to proceeding. The shell history was also modified to remove references to commands and files involved in the intrusion, as well as several system logs were modified to minimize evidence of the intrusion.
SSHd was trojanized to serve a direct credential theft function.
It captured plaintext passwords before encrypting and storing them at a fixed location on the compromised host. Rapid7 tracked curlRAT as another component that provided operators with remote access and communication. It normally contacts its control infrastructure every 12 hours, but may switch to a 30-second interval if instructed to do so.
Prior to being executed, the malware also checked for a marker indicating that the system was virtualized.
Attribution Points to North Korean Activity
In Rapid7's assessment, North Korean state-sponsored actors were identified as being responsible for the campaign. It is consistent with an espionage-focused operation that South Korean automotive and media companies were targeted, even though available evidence does not specify how the victims were initially compromised.
APT37-associated threat intelligence records contain some infrastructure linked to the toolkit. However, Rapid7 cautions that the evidence spans several North Korean threat clusters, making attribution more difficult because the broader delivery approach is similar to previous campaigns targeting South Korean organizations.
SyncHole, which was an earlier campaign that selectively redirected visitors to South Korean websites, also has similarities to the research. In campaigns designed to target specific users without disrupting normal website activity, traffic filtering and selective content delivery remain effective techniques.
HAProxy Builds Create a Difficult Detection Problem
There was an infection in both affected organizations with HAProxy 2.8.12, released in November 2024. The implant is based on internal structures related to that specific release, suggesting that the malicious code has been constructed around existing software environments in both organisations.
In addition to updating HAProxy, the threat resides within a replaced binary, rather than exploiting a HAProxy flaw, and would not be removed by updating alone.
The case also emphasizes the difficulty of identifying malicious code embedded in trusted infrastructure when it is complemented by network correlation and memory-based behavioral analysis.
In addition to continuing to handle legitimate traffic normally, a compromised load balancer provides attackers with a concealed position through which they can inspect traffic, collect credentials, and execute commands.
