A backdoor compiled into HAProxy intercepts traffic and vanishes from the load balancer’s counters

September 4, 2026. Rapid7 Labs publishes its analysis of an implant named ted, compiled directly into HAProxy 2.8.12 at two South Korean organizations. November 22, 2024. The release date of 2.8.12-0fdb194, the version the implant derives from — the earliest possible compile date for the modified binary. Mid-2025. The first uploads of the toolkit surface on VirusTotal. Why it matters: this is not an HAProxy vulnerability to patch, but an edge rootkit that intercepts web traffic and erases itself from the load balancer’s connection counters.

Not an HAProxy flaw, an implant compiled into the binary

Rapid7 is explicit about a point headlines routinely bury: ted exploits no HAProxy vulnerability. Installing it already requires code execution on the host and the ability to replace the running binary. That is what separates this report from a routine security advisory — the fix is not a version patch, but the detection of a compromise already in place.

The implant is compiled inside the victim’s own HAProxy 2.8.12. It leans on the native filter API, internal memory pools, the event scheduler, and the process-management machinery of the proxy: legitimate traffic keeps being balanced as expected while the malicious code blends into the software’s normal behaviour. It is that depth of integration — not the cleverness of an exploit — that makes the implant hard to spot.

The toolkit is not limited to HAProxy. Rapid7 found the same code in trojanized builds of crond, agetty, atd, sshd, and polkitd. An SSH keylogger encrypts captured plaintext passwords and writes them to a fixed path. A stager deploys only where HAProxy or cron is already running, verifies it is root, overwrites the legitimate crond binary and backdates it with the creation timestamp of /usr/bin/ssh to muddy audits. It then strips the keywords tmp, wget, cron and crond from root’s bash history and from six system logs, including auth.log and audit/audit.log.

A command channel that disappears from the counters

The command-and-control (C2) mechanism is the most striking part of the report. A request to a specific image path flips the filter into C2 mode. The implant then decrements HAProxy’s live connection counters, dropping the connection from the load balancer’s statistics, writes the command body to a named pipe under /tmp, and zeroes the request channel afterwards: there is nothing left to forward, and the command terminates at the proxy. Neither the backend logs nor the load balancer’s statistics retain any trace of the exchange.

The output returns on the raw socket under an HTTP/1.0 200 OK header, which makes the exchange look like ordinary web traffic. Through that channel the operator can beacon, upload and download files, run shell commands, and replace the implant’s configuration.

Only requests that clear four checks receive a modified page: a User-Agent must be present; the request must match a rule whose URL and referer patterns both fit; and delivery then depends on either whitelist membership of the client address — checked at the exact address and again at the /24 level — or an operator key in the Accept-Language header that overrides the address filtering entirely. On the way out, the implant rewrites the content type and length, forces the status to 200, and drops the Accept-Ranges header so a client cannot request byte ranges and notice the size change. The end result is a channel that survives ordinary log review: a defender watching backend access logs or HAProxy statistics sees neither the operator’s commands nor their replies, only an unremarkable 200 OK.

A North Korean shadow and a groupware entry point

Rapid7 attributes the toolkit, with medium confidence, to North Korean state-sponsored actors — the post is filed under “DPRK APTs”. The two documented victims belong to South Korea’s automotive and media sectors, recurring targets for Pyongyang-linked groups. Rapid7 nonetheless notes that “further evidence is necessary” for a definitive attribution.

On the entry point, the analysts established no timeline. Their hypothesis — an initial compromise through an exposed groupware portal, that class of enterprise collaboration software widespread in Korea — rests on ENKI’s research, which documented Kimsuky compromising a groupware vendor through a mail-server flaw with a variant of the Gomir family.

That entry chain fits the group’s playbook: a quiet first compromise, then deep-persistence implants in system and edge binaries. The companion curlRAT beacons every 12 hours by default and drops to a 30-second interval when the operator sets a flag; it aborts unless it finds a marker file showing the host is virtualized.

Detecting a trojanized proxy

With no patch to apply, the response is an integrity and monitoring posture. Rapid7’s published indicators give a concrete first list: the domains img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store and img.worksongo[.]store, plus the files ~/cache/haproxy-1000.cache and /var/lib/sshd/c8c68e629bba773.

# Verify the integrity of the HAProxy binary (RPM)
rpm -V haproxy

# Compare the running binary's hash against the repository build
sha256sum /usr/sbin/haproxy

# Look for the documented marker files and implant paths
ls -la ~/cache/haproxy-1000.cache /var/lib/sshd/c8c68e629bba773 2>/dev/null

# Watch for anomalous connection counters
echo "show info" | socat stdio /run/haproxy/admin.sock | grep -i cur

Monitoring should target counter anomalies as much as binaries. An HAProxy whose active connection count drops for no reason mid-exchange, or whose statistics no longer match the backend logs, warrants an integrity audit. The same logic extends to the trojanized system binaries: a crond or sshd whose checksum no longer matches the package database is a smoking gun even before any C2 traffic is observed. Because the stager backdates timestamps and scrubs history, rely on hashes rather than file times or shell history. Organizations that run their edge proxies as immutable infrastructure — signed binaries, AIDE or an equivalent on alert, image-based updates — mechanically shrink the surface for such an implant.

A precedent: XZ Utils and the rise of supply-chain implants

ted belongs to a trend infrastructure teams have learned to dread. In March 2024, the XZ Utils backdoor — injected into a compression library present on nearly every Linux distribution — nearly opened a universal SSH backdoor before being caught by accident. The common thread is striking: in both cases, compromise does not come through a remotely exploitable flaw, but through the substitution of a trusted component at the heart of a production system.

The lesson is structural. A proxy, a system daemon or a locally compiled library escapes the classic controls that target web applications and their patches. The defense that works is not a patch — there is nothing to patch — but integrity: signatures, hashes, reproducible builds, and monitoring that detects when a binary or a counter behaves differently than before. Rapid7 also notes that the stager wipes its traces from logs after installation, which makes after-the-fact detection more reliable than live hunting.

Verdict

If you run HAProxy at the edge, treat this report as an integrity signal rather than a patch notice: verify your binary hashes, deploy file-integrity monitoring, and alert on abnormal drops in connection counters.

If you expose a groupware portal or a corporate mail server, harden it first: it is the most plausible entry point for the toolkit, and the initial compromise always precedes the installation of ted.

Either way, do not go looking for an HAProxy patch — there is none, because the flaw is not in HAProxy. It is the prior compromise you must prevent, and then detect.

References

• Rapid7 Labs — DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
• The Hacker News — New Ted Backdoor Hides Inside Victims’ Own HAProxy Builds to Intercept Web Traffic
• ENKI — Analysis of Kimsuky’s attack on a South Korean groupware vendor using a new Gomir family variant