Active Exploitation Alert: North Korean APTs Deploy Ted Backdoor in Compromised HAProxy Builds to Hijack Web Traffic

Executive Summary

A newly identified and highly sophisticated backdoor, known as Ted, has been discovered embedded within custom builds of the widely deployed open-source load balancer HAProxy. This campaign, attributed with medium confidence to North Korean advanced persistent threat (APT) groups such as APT37 and Lazarus, leverages the trusted position of HAProxy in enterprise environments to intercept, manipulate, and exfiltrate web traffic. By integrating directly into the HAProxy binary, the Ted backdoor achieves a high degree of stealth, evading traditional detection mechanisms and posing a critical risk to organizations relying on HAProxy for secure and efficient traffic management. The campaign has been observed targeting South Korean media and automotive sectors, but the underlying techniques are broadly applicable and represent a significant supply chain and watering-hole threat to any organization using custom-compiled HAProxy binaries.

Threat Actor Profile

The Ted backdoor campaign is attributed to North Korean APT groups, specifically APT37 (also known as Reaper or Kimsuky) and the Lazarus Group. These actors are known for their advanced capabilities in supply chain compromise, watering-hole attacks, and the use of custom malware with sophisticated evasion techniques. Both groups have a history of targeting South Korean critical infrastructure, media, and automotive sectors, often leveraging public-facing application vulnerabilities and exploiting trusted open-source software. The infrastructure supporting the Ted campaign mimics legitimate South Korean web platforms and employs a variety of top-level domains, including .store, .space, .site, and .autos, with subdomains designed to appear benign (e.g., img.*). The operational overlap with campaigns such as Operation SyncHole (as reported by Kaspersky) further supports the attribution to these North Korean threat actors.

Technical Analysis of Malware/TTPs

The Ted backdoor is not a vulnerability in the official HAProxy codebase, but rather a malicious plugin or module compiled directly into custom builds of HAProxy (notably version 2.8.12-0fdb194, released November 2024). The infection chain typically begins with exploitation of public-facing applications, such as groupware login portals or mail servers, using remote code execution (RCE) vulnerabilities. While no specific CVE has been confirmed, the TTPs align with previous campaigns by Kimsuky and Lazarus.

Once initial access is achieved, attackers deploy a stager that checks for the presence of HAProxy or cron before dropping further payloads. The Ted backdoor is compiled into HAProxy using its filter API and internal memory pools, allowing it to hook into the HTTP parser and intercept high-value traffic, including login endpoints, session cookies, and HTTP headers. The backdoor supports selective injection of malicious scripts into web responses, using regex-based rules that target victims based on IP address, User-Agent, Referer, and Accept-Language headers.

Command and control (C2) is established via covert HTTP channels, often using custom endpoints such as /favorite_list_2x_m500_ico.jpg. The backdoor supports file upload/download, command execution, configuration updates, and beaconing. To evade detection, Ted scrubs HAProxy connection counters and logs, encrypts configuration and payloads with chained XOR and monoalphabetic substitution, and uses named pipes and environment variables for inter-process communication and persistence. Additional persistence is achieved by trojanizing system binaries such as crond, agetty, atd, sshd, and polkitd.

The campaign also leverages a secondary malware component, curlRAT, which maintains a watchdog thread to monitor HAProxy health, provides reverse and PTY shells, and supports staged payload delivery. curlRAT communicates with C2 over HTTPS (with HTTP fallback), using feedback XOR and Base64 encoding for data exfiltration. Host and system profiling is performed to tailor payload delivery. The stager component overwrites system daemons, timestomps binaries, and erases installation traces from logs, further complicating forensic analysis.

Credential harvesting is a key capability, with an SSH keylogger intercepting plaintext credentials and storing them encrypted on disk. The campaign’s stealth is enhanced by log manipulation, timestamp alteration, and the use of encrypted configuration files.

Exploitation in the Wild

The Ted backdoor has been confirmed in the wild, primarily affecting South Korean automotive and media organizations. The earliest known uploads of trojanized HAProxy binaries to VirusTotal date to mid-2026. Attackers have targeted edge webservers with exposed ports (80, 443, 25), exploiting groupware login portals and mail servers as initial access points. Watering-hole attacks have been observed, with malicious content selectively injected for targeted users based on detailed fingerprinting. The campaign’s use of custom-compiled HAProxy binaries means that any organization building HAProxy from untrusted sources or on compromised build systems could be at risk, regardless of sector or geography.

Victimology and Targeting

The primary victims of the Ted backdoor campaign are organizations in the South Korean automotive and media sectors. The targeting aligns with the strategic interests of North Korean APT groups, who have previously focused on South Korean critical infrastructure and intellectual property. The campaign’s use of watering-hole techniques and supply chain compromise suggests that other sectors and regions could be at risk, particularly those relying on custom-compiled HAProxy binaries or operating in environments with limited patch management and binary integrity controls. The attackers demonstrate a high degree of selectivity, using fingerprinting to inject malicious payloads only for specific users or endpoints, thereby reducing the likelihood of broad detection.

Mitigation and Countermeasures

Organizations should immediately verify the integrity of all HAProxy binaries in use, comparing them against official cryptographic hashes provided by the HAProxy project. Only binaries obtained from trusted sources or built from verified source code on secure build systems should be deployed. Behavioral monitoring should be implemented to detect unusual network connections or traffic patterns associated with HAProxy processes. YARA rules for Ted and curlRAT signatures, available from community sources such as ThreatFox, should be deployed to enhance detection capabilities.

Network monitoring should focus on identifying connections to known C2 domains (e.g., img.monderhouse.space, img.smartnords.site, img.darklights.store, img.responsive.pstatic.autos, img.socialteams.store, img.worksongo.store) and unusual HTTP endpoints such as /favorite_list_2x_m500_ico.jpg. System administrators should inspect for the presence of named pipes in /tmp (e.g., /tmp/t[ID]_w.pipe) and encrypted credential files at /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19. Log analysis should include checks for erased or manipulated logs, particularly in /var/log and /root/.bash_history.

Patch management processes should be reviewed to ensure all systems and software, including HAProxy, are up to date with the latest security patches. Network segmentation should be employed to limit HAProxy’s access to sensitive internal resources. Regular credential audits and the use of multi-factor authentication can reduce the risk of credential theft and lateral movement.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their supply chain and digital ecosystem. Our advanced threat intelligence and automation capabilities empower security teams to identify emerging threats, ensure compliance, and protect critical assets from sophisticated adversaries. For more information about how Rescana can help your organization strengthen its cyber resilience, please contact us at info@rescana.com.