Backdoor Found in Trojanized HAProxy Load Balancers

Security researchers have documented a previously unknown Linux backdoor named ted that was compiled directly into trojanized HAProxy load balancers at two South Korean organizations. HAProxy is a widely used open-source program that distributes incoming web traffic among multiple servers, and the modified versions intercepted that traffic and served altered pages to selected visitors. Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors and placed the two victims in South Korea's automotive and media sectors. The implant is not a vulnerability in HAProxy itself: installing it requires an attacker to already have code execution rights on the host and the ability to replace the running binary, which is the compiled executable file.

The backdoor hides command-and-control traffic, communications between the attacker and the implant, from normal monitoring. When HAProxy receives a request for one specific image path, the filter enters remote-control mode. The implant then reduces HAProxy's own live-connection counters, which removes that connection from the load balancer's statistics, writes the command body to a named pipe, a special file used to pass data between programs, under /tmp, and zeroes the request channel so nothing is forwarded to a backend server. The command stops at the load balancer, while the output returns on the raw socket with a standard HTTP/1.0 200 OK header. Because the reply looks like an ordinary web response, the exchange blends in with normal traffic. Through this channel an operator can beacon, upload and download files, run shell commands, and replace the implant's configuration.

Only requests that pass four checks receive a modified page. The request must include a User-Agent header, which is the text a browser sends to identify itself, and it must match a rule where both the requested URL and the referer, the page that linked to the request, fit specific patterns. Delivery then depends on either a whitelist of client addresses checked exactly and again at the /24 block level (a group of 256 IP addresses), or an operator key placed in the Accept-Language header, which normally tells the server which language the visitor prefers. That key overrides the address filtering entirely. On the way out, the implant rewrites the content type and content length, forces the response status to 200, and removes the Accept-Ranges header so a client cannot request byte ranges and notice that the page size changed.

Rapid7 said its evidence was not enough to establish a timeline or determine how the attackers first got in. Its hypothesis that they entered through an exposed Groupware portal, a class of Korean enterprise collaboration software, rests on earlier ENKI research that documented Kimsuky compromising a groupware vendor through a mail server flaw. The stager, the component that installs the implant, deploys only where HAProxy or cron is already running, and it verifies that it has root, the highest-privilege administrator account, before dropping anything. It overwrites the legitimate crond binary, the system service that runs scheduled tasks, and gives the replacement the creation timestamp of /usr/bin/ssh. It then removes the keywords tmp, wget, cron and crond from root's bash history and from six system logs, including auth.log and audit/audit.log. A trojanized sshd, the secure shell service that handles remote logins, encrypts captured plaintext passwords and writes them to a fixed path. Rapid7 found the same code in trojanized agetty, atd, and polkitd binaries. A companion remote access trojan that Rapid7 calls curlRAT beacons every 12 hours by default and switches to a 30-second interval when the operator sets a flag. It aborts unless it finds a marker file showing that the host is virtualized. curlRAT is distinct from CurlBack RAT, a separate family of that name attributed to the Pakistan-linked SideCopy group.

The report lists six domains, several file paths and two SHA-256 hashes as indicators of compromise. The domains are img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store and img.worksongo[.]store. The Hacker News confirmed on September 4 that none of the six domains resolves, returning NXDOMAIN, the DNS answer meaning no such name exists, for both A and NS records via Google Public DNS. This means they are useful for reviewing historical logs rather than for blocking live traffic. Part of the attribution rests on a listing of those domains under APT37 in maltrail, an open-source detection project. The maltrail file Rapid7 links stopped resolving after a repository restructure in August moved the project's static trail data elsewhere, but The Hacker News confirmed on September 4 that all six are present at the new location, each labelled as APT37 infrastructure. The maltrail APT37 source file credits those entries to two posts on X from July 2025 and carries no reference to Rapid7. Six further domains sit in the same two maltrail entries but not in Rapid7's list: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online and app.cleanos[.]online. Rapid7 has not said whether they are the same infrastructure. The ThreatFox tag Rapid7 names as its second source for the same domains records five sightings, all timestamped July 2, 2025. One of the two X posts maltrail cites was published three hours earlier that day.

The attribution passage draws on three separate North Korean clusters: APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Mandiant's 2023 assessment of North Korean cyber structure recorded shared tooling and overlapping targeting across those clusters, and Mandiant said that this would make precise attribution more difficult. Rapid7 compared the delivery model to the Operation SyncHole campaign, in which visitors to South Korean online media sites were filtered by a server-side script and redirected. Kaspersky researchers Sojun Ryu and Vasily Berdnikov assessed with medium confidence that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper. Kaspersky's SyncHole report identified at least six victims in the software, IT, financial, semiconductor manufacturing and telecommunications sectors. Both victims in the new case ran HAProxy 2.8.12, released on November 8, 2024. The implant reads HAProxy's internal structures at offsets fixed to that release, and Rapid7 does not say whether other 2.8 builds exist. The current release on that branch is 2.8.28, from August 27, 2026, sixteen point releases later. HAProxy's tracker lists 529 known bugs affecting 2.8.12 that are already fixed in the branch, including one critical and sixteen major. Upgrading does not clean a host the implant already sits on, because the attackers replace the binary rather than exploit a flaw in