NORTH Korea‑linked threat actors have concealed a backdoor inside the HAProxy load balancer, affecting edge devices in two South Korean networks. Rapid7’s analysis describes a Linux toolkit, dubbed the ted backdoor by researchers, that is not a separate process but compiled directly into HAProxy’s source as a custom plugin.
The implant targets HAProxy version 2.8.12 and uses the software’s native filter API, memory pools and event scheduler to intercept HTTP traffic while legitimate load balancing continues uninterrupted.
The campaign is said to have reached South Korea’s automotive and media sectors, with further components that modify common Linux daemons (crond, agetty, atd, sshd) and include an SSH keylogger, plus a tool named curlRAT that periodically contacts a remote server and checks for virtualised environments to avoid analysis.
The backdoor enables remote command execution, injection of malicious scripts into web traffic, credential harvesting, and long‑term surveillance, all while erasing traces from logs by manipulating internal counters and forwarding buffers so that malicious activity does not reach backend servers. The operation’s sophistication includes the ability to alter page content for specific targets and to hide evidence at the HTTP level, indicating deep integration with HAProxy internals.
Attribution is given at a medium level of confidence, with links to North Korean activity (APTs associated with APT37 and Lazarus‑style overlap) but with caveats that evidence is not definitive. Practically, defenders are urged to treat edge components handling SSL termination and traffic routing with the same rigor as core applications, employing independent network correlation and binary integrity checks rather than relying solely on internal logs.