Rapid7 found the Ted backdoor compiled into trojanized HAProxy 2.8.12 builds at two South Korean organizations. It is not a HAProxy vulnerability. It requires prior code execution and binary replacement.
Command-and-control requests get handled inside HAProxy itself, so they never reach backend application logs.
A supporting toolkit, including curlRAT, a stager, and a trojanized SSH daemon, steals credentials and erases forensic traces.
Rapid7 attributes the activity to North Korean cyber espionage actors with medium confidence, citing APT37 infrastructure links. Rapid7 could not confirm the initial access method or build a full intrusion timeline.
Rapid7 Labs disclosed a Linux toolkit hidden inside a victim’s load balancer software. The researchers named the implant the Ted backdoor, based on debug strings left in the binary. Attackers compiled the Ted backdoor directly into trojanized HAProxy builds running at two South Korean organizations, one in the automotive sector and one in media.
The implant does not exploit a flaw in HAProxy’s code. Instead, the operators needed code execution on the host first, then replaced the running HAProxy binary with their own build. Once in place, the implant intercepted web traffic passing through the load balancer and served altered pages to specific visitors, all while genuine traffic kept flowing normally.
Rapid7 attributed the campaign with medium confidence to North Korean state-sponsored activity, citing infrastructure overlaps with APT37 tracked by ThreatFox and Maltrail. The firm also found this implant sitting alongside a wider toolkit built for long-term access and credential theft.
What the Ted Backdoor actually does inside HAProxy
The Ted backdoor does not run as a separate process next to HAProxy. Attackers built it directly into the load balancer’s own code. It reuses HAProxy’s native filter API, memory pools, event scheduler, and process management infrastructure to operate.
This design gives the implant several capabilities:
A request to one specific image path, such as /favorite_list_2x_m500_ico.jpg, switches the implant into command mode.
Once in command mode, it can beacon to command infrastructure, upload and download files, execute shell commands, and rewrite its own configuration.
For web injection, it matches incoming requests against operator-defined regex rules covering the User-Agent, URL, and Referer values before deciding whether to serve altered content.
A separate header-based operator key can override client-address whitelisting, so a visitor without whitelisted access can still receive the modified page.
It serves altered pages only to selected visitors, keeping the campaign narrow and harder to spot.
Because the Ted backdoor lives inside a trusted, already-running process, standard endpoint tools that watch for new or unusual binaries can miss it entirely.
Why backend logs miss the Ted Backdoor’s traffic
HAProxy normally sits between users and backend applications, forwarding requests and logging what passes through. The Ted backdoor breaks that assumption. It intercepts and answers command-and-control requests at the load balancer layer itself, so those requests never reach the backend servers.
Backend web-server logs and application logs stay clean. Counters that track normal traffic volume exclude the C2 requests entirely. A security team reviewing only backend telemetry would see nothing unusual, even while the Ted backdoor actively communicates with its operators.
Top 10 Cybersecurity Challenges for Enterprises
Top 10 enterprise cybersecurity challenges, risks, and Hexnode's mitigation strategies.
The rest of the toolkit: curlRAT, a Stager, and an SSH Keylogger
Rapid7 found the Ted backdoor operating alongside several other trojanized components on the same hosts:
curlRAT, a curl-based remote access trojan that runs a watchdog thread to monitor HAProxy’s health and report status back to the operators.
A stager, built from a trojanized crond binary, that deploys only where HAProxy or cron already runs and checks for root privileges before dropping anything. Rapid7 found the same trojanizing code in additional system service binaries, including agetty, atd, and polkitd, extending the toolkit’s footprint well beyond the load balancer itself.
A trojanized SSH daemon that captures plaintext credentials, encrypts them, and writes them to a fixed path on disk.
The stager also covers its tracks. It gives its replacement crond binary the file creation timestamp of the legitimate ssh binary, then strips keywords tied to its own deployment from root’s bash history and from several system logs, including authentication and audit logs.
Rapid7’s earliest VirusTotal samples date to mid-2025, though the HAProxy 2.8.12 build the toolkit trojanizes shipped in November 2024, setting the earliest possible compilation window.
Ted Backdoor toolkit components
Component
Function
Operational Risk
Ted backdoor (HAProxy)
Intercepts web traffic, serves altered content, executes commands
High — embedded in trusted, always-running infrastructure
curlRAT
Curl-based RAT that monitors implant health and reports to operators
Medium — persistent secondary C2 channel
Trojanized SSH daemon
Captures and encrypts plaintext login credentials
High — direct credential theft
Stager (trojanized crond,agetty, atd, polkitd)
Deploys payloads and erases log and history traces
High — undermines forensic investigation
Attribution and the open access question
Rapid7 built its medium-confidence North Korean attribution on three separate clusters: APT37 infrastructure overlaps tracked by ThreatFox and Maltrail, a delivery model resembling the Lazarus-linked Operation SyncHole campaign, and an initial-access hypothesis tied to Kimsuky.
Rapid7 did not confirm how the attackers first gained access. The firm raised a hypothesis, based on separate ENKI research documenting a Kimsuky compromise of a Korean groupware vendor, that an exposed Groupware portal, a category of Korean enterprise collaboration software, may have provided the initial foothold.
Rapid7 presented this as a hypothesis, not a confirmed finding, and the firm could not build a full intrusion timeline from the available evidence.
What security teams should check now?
Standard vulnerability scanners and patch deployment tools will report HAProxy 2.8.12 as up to date, since the version string matches a legitimate release. Version checks alone will not catch this implant.
Run cryptographic hash verification, such as SHA-256, against clean vendor-provided binaries for the deployed version, rather than relying on version-string checks.
Deploy file integrity monitoring on Linux edge servers running load balancers, so any unauthorized binary replacement triggers an alert.
Search for anomalous debug strings or unexpected filter modules compiled into production builds.
Review authentication and audit logs for gaps or signs of tampering, not just their contents.
Confirm administrator endpoints used to manage load balancers carry current security updates. Server patching and endpoint patch hygiene are separate controls.
Extend monitoring beyond backend application logs to cover the load balancer layer itself.
Featured resource
Cybersecurity kit
Free cybersecurity kit: blueprint, framework guide, IT checklist, incident policy template, UEM infographic, and management guides.
Is the Ted backdoor a HAProxy vulnerability that needs a patch?
No. Rapid7 described it as a trojanized build, not a flaw in HAProxy’s official code. Attackers still needed prior code execution and the ability to replace the running binary.
How would a team notice a Ted backdoor infection given clean backend logs?
Backend logs will not show it, since command-and-control traffic never reaches them. Teams need binary integrity checks against known-good HAProxy hashes and closer review of the load balancer host itself.
Does removing the Ted backdoor fully remove the threat?
Not on its own. Rapid7 found a broader toolkit on the same hosts, including curlRAT, a trojanized SSH daemon, and a stager, so a full host review matters beyond just the HAProxy binary.
Conclusion
The Ted backdoor shows how attackers can turn trusted traffic infrastructure into a blind spot once they gain a foothold on the host. By compiling directly into HAProxy, the Ted backdoor intercepts traffic and hides its command-and-control activity from the logs security teams check first.
Organizations running HAProxy or similar load balancers should verify binary integrity, extend monitoring beyond backend logs, and treat administrator access to traffic infrastructure as a priority control point, not an afterthought.
Hidden in your load balancer? Check now.
Get security briefings like this one, straight to your inbox.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
