Rapid7 Labs disclosed a Linux toolkit hidden inside a victim’s load balancer software. The researchers named the implant the Ted backdoor, based on debug strings left in the binary. Attackers compiled the Ted backdoor directly into trojanized HAProxy builds running at two South Korean organizations, one in the automotive sector and one in media.<\/p>\n
The implant does not exploit a flaw in HAProxy’s code. Instead, the operators needed code execution on the host first, then replaced the running HAProxy binary with their own build. Once in place, the implant intercepted web traffic passing through the load balancer and served altered pages to specific visitors, all while genuine traffic kept flowing normally.<\/p>\n
Rapid7 attributed the campaign with medium confidence to North Korean state-sponsored activity, citing infrastructure overlaps with APT37 tracked by ThreatFox and Maltrail. The firm also found this implant sitting alongside a wider toolkit built for long-term access and credential theft<\/a>.<\/p>\n