DPRK operators compiled their backdoor into the victim's own HAProxy build
Rapid7 says the ted backdoor is built into the victim's existing HAProxy 2.8.12 and hooks its filter API, so the load balancer keeps balancing normally while it logs cookies and injects scripts for selected clients.
The Watch · Security desk
What happened
- Rapid7 Labs documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, built around a HAProxy implant it calls the ted backdoor.
- The implant is compiled as part of the victim's existing HAProxy 2.8.12 and rides the native filter API, memory pools, event scheduler and process management while genuine load balancing continues.
- Its custom filter hooks the HTTP parser to log high-value traffic and steal session cookies, and selects client IPs to decide which browsers get injected scripts.
- Trojanized copies of crond, agetty, atd, sshd and polkitd sit alongside it on compromised hosts.
- Rapid7 attributes the toolkit with medium confidence to DPRK APTs, citing the victimology, xor-based encryption, a custom substitution cipher, and hardcoded C2s that ThreatFox and maltrail link to APT37.
Why it matters
- What it limits constraint Process- and traffic-level monitoring on the edge has nothing anomalous to surface, so verification moves to comparing running binaries against what the packages installed.
- Who's exposed exposure Every client that transits the compromised balancer is reachable by the operators, which turns the victim's own users and partners into the next stage of the intrusion.
- Who has to decide decision With no confirmed entry point and no CVE, teams running exposed groupware and mail on the same edge host cannot patch their way out of this and have to hunt on the load balancer instead.
- What doesn't add up contradiction Kimsuky supplies the initial-access hypothesis while APT37 supplies the C2 overlap, so the evidence supports DPRK-nexus far better than it supports any single named group.
Next story · Security · 7h ago
F5 patches three CVSS 9.2 NGINX flaws that only certain configurations exposeConfirmed2 publishers
The operators' priorities show up in the watchdog. Rapid7 says the curl-based RAT that ships with this toolkit keeps a thread whose job is to track HAProxy's health and report it back to operator infrastructure [7]. The load balancer is the asset, and the rest of the kit exists just to keep it running and reachable.
The chain, as far as Rapid7 reconstructed it, runs through the edge box. Both victims exposed ports 80, 443 and 25, with a Groupware login portal on 443 and a mail server on 25 [5]. After the foothold, credentials come off that host, including plaintext passwords lifted by an SSH keylogger [12], and the same host doubles as the staging server for the trojanized system ELFs [11]. A stager then goes to internal servers, checks whether crond or HAProxy is present, and only then deploys CurlRAT, pulling it from its own data section or back from the edge webserver [13]. In parallel ted lands on the load balancer and opens its own C2 channel for exfiltration, command execution and injection [14]. Clients browsing through that balancer are then served the malicious content, which closes the watering-hole loop [15].
Rapid7's initial-access hypothesis leans on Kimsuky, which it says has been exploiting RCE flaws in externally accessible mail servers to compromise South Korean groupware vendors since the beginning of 2026 [10]. The attribution for the toolkit itself leans on C2 overlap with APT37 [9]. The report cites two separate DPRK clusters for two different parts of the same finding, and names no CVE for either.
On dating, the source gives two fixed points. The HAProxy 2.8.12-0fdb194 build was released on 22 November 2024, which is the earliest date the plugin could have been compiled against it [18], and the earliest VirusTotal uploads are mid-2025 [17]. That is a compile window of roughly seven months [20], against campaign activity Rapid7 places back to early 2025 [8].
What that leaves defenders is thin on indicators and specific on files. This material publishes one SHA-256, for the SSH keylogger [12]. A filter plugin built into the same service version the operator installed does not add a process to the process table, and legitimate load balancing keeps working while it runs [4]. So the check that matches the finding is comparing what is running on the edge against what the package should have put there: HAProxy first, then crond, agetty, atd, sshd and polkitd [2]. That gap means endpoint telemetry alone would not have surfaced this activity.
Rapid7 also says ted may belong to a wider framework that includes an nginx backdoor [19]. If that lands with samples, the same reasoning applies to a much larger installed base.
What to watch
- Whether the nginx backdoor Rapid7 says may belong to the same framework surfaces with samples and hashes.
- Whether a specific CVE is confirmed for the Groupware portal or mail server entry point on the edge webserver.
- Whether the medium-confidence DPRK attribution firms up, or the C2 overlap resolves to a cluster other than APT37.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption10
- Hype gap+20
- Incentives35
- Confidence66
Perspective Coverage
5 publishers- Builder
- Builder 42%
- Operator
- Operator 53%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Rapid7 Labs identified a new Linux toolkit targeting organizations across South Korea's automotive and media industries with minimal detection.
- [2]
The campaign made use of a HAProxy instance named "ted backdoor", alongside trojanized versions of crond, agetty, atd, sshd and polkitd.
- [3]
The framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting and engage in long-term surveillance.
- [4]
The ted backdoor is compiled as part of the victim's existing HAProxy version 2.8.12 and uses its native filter API, internal memory pools, event scheduler and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.
- [5]
At the time of analysis both victims were running an edge webserver with ports 80, 443 and 25 exposed; port 443 hosted the Groupware login portal and port 25 exposed a mail server.
- [6]
The ted plugin registers a custom HAProxy filter that hooks the HTTP parser to inspect and log high-value traffic, steal session cookies, and perform a client IP selection to decide whether to inject custom scripts into the webpage being rendered.
- [7]
Operating alongside ted are an SSH keylogger, a curl-based RAT and a stager; the RAT maintains a watchdog thread dedicated to tracking HAProxy's health and reporting it back to the operator's infrastructure.
- [8]
Rapid7 researchers say the toolkit was used in campaigns targeting South Korean automotive and media sectors likely dating back to early 2025.
- [9]
The toolkit is attributed with medium confidence to DPRK APTs, based on the South Korean media and automotive victimology, simple xor-based encryption, a custom substitution cipher, and hardcoded C2s associated with APT37 by ThreatFox and maltrail.
- [10]
Rapid7 states that since the beginning of 2026 Kimsuky has been observed exploiting RCE vulnerabilities in externally accessible mail servers to compromise South Korean groupware vendors, and that either the Groupware portal or the mail server is a plausible initial access vector consistent with Kimsuky tradecraft.
- [11]
The attackers establish persistence and harvest credentials from the compromised edge host, which also doubles as a staging server hosting the trojanized system ELFs.
- [12]
The SSH keylogger, hash 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5, intercepts legitimate users' plaintext passwords.
- [13]
The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or from the edge webserver.
- [14]
Once active on the HAProxy load balancer, ted backdoor establishes its own C2 channel to external operator infrastructure, enabling data exfiltration, command execution and script injection.
- [15]
The compromised load balancer silently redirects or serves malicious content to selected clients browsing through it, completing the watering-hole loop.
- [16]
Rapid7 says the gathered evidence does not suffice to establish a timeline or how initial access was performed; the published attack chain is partially reconstructed and assumes initial access via exploitation of CVEs related to the Groupware portal, with the specific entry point and any associated CVE unconfirmed.
- [17]
The earliest uploads of the toolkit samples on VirusTotal date back to mid-2025.
- [18]
HAProxy 2.8.12-0fdb194 was released on 22 November 2024, establishing that as the earliest possible compilation date for this build.
- [19]
Rapid7's analysis indicates the ted backdoor could be part of a broader framework covering an nginx backdoor as well.
- [20]
The window between the release of the HAProxy 2.8.12-0fdb194 build and the earliest VirusTotal upload of the samples is roughly seven months.
Sources
5 independent publishers whose own reporting we read for this story.
- blog.rapid7.comDPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
1 article · September 4, 2026
- scworld.comNew Linux toolkit found in trojanized HAProxy targeting South Korean organizations
1 article · September 4, 2026
- securityaffairs.comNorth Korea-linked Hackers Hide a Backdoor Inside HAProxy
1 article · September 8, 2026
- securityweek.comNorth Korean Hackers Deploy New Linux Espionage Toolkit
1 article · September 7, 2026
- thehackernews.comNew Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
2 articles · September 5, 2026
Topics and entities
Topics
- Watering-hole attacks
- State-Sponsored Cyber Espionage
- Edge and perimeter infrastructure security
- Linux malware