RAPID 7 has revealed a previously undocumented toolkit trojanised into the HAProxy load balancers of two South Korean organisations, allowing an attacker to intercept web traffic and present altered pages to selected visitors. The implant, named ted in debug strings, is not a HAProxy vulnerability; it requires code execution on the host and the ability to replace the running binary.
The affected victims run HAProxy 2.8.12 (the two victims’ version), with the current HAProxy branch at 2.8.28 released on 27 August 2026. Rapid7 notes that upgrading does not clean an already-compromised host since the attackers replace the binary rather than exploiting a flaw.
The backdoor communicates via a server-side filter that only affects certain requests and can beacon, upload/download files, run shell commands, and modify the implant’s configuration through a dedicated channel. C2 traffic never touches a backend server and is erased from HAProxy’s connection counters, meaning backend logs and load balancer statistics do not record it.
The compromise uses a combination of whitelisting, exact IP checks, and an operator key in Accept-Language to filter which users see the malicious content. IoCs provided include several domains (e.g., img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store), specific files, and SHA-256 hashes (72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 and 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5).
Rapid7’s evidence also points to North Korean actors with links to APT37, Lazarus, and Kimsuky in related campaigns. Respondents are urged to perform independent network correlation, memory analysis, and binary integrity checks, noting that recompiled HAProxy binaries report the same version string as clean builds.