Loading malware…
Ted is a Linux backdoor implanted into trojanized HAProxy load-balancer binaries. Observed at South Korean automotive- and media-sector organizations, it uses HAProxy internals to covertly inspect HTTP traffic, identify selected visitors, and alter responses while retaining normal load-balancing behavior. It can capture session cookies and selectively inject scripts or other modified web content based on request attributes including User-Agent, URL, referrer, and client address.
Ted contains a concealed HTTP command-and-control channel activated by specially crafted requests. It can execute shell commands, upload and download files, modify its configuration, and return command output disguised as ordinary HTTP responses. Its C2 requests are handled within the load balancer rather than forwarded to backend applications, and it suppresses relevant connection accounting and clears request data to reduce visibility in backend logs and HAProxy statistics.
Ted is not an HAProxy vulnerability. Its deployment requires prior code execution, typically with root-level privileges sufficient to replace the legitimate HAProxy executable. The associated intrusion toolkit included trojanized Linux services, credential-capturing SSH functionality, trace removal, and curlRAT. Activity involving Ted was assessed with medium confidence as linked to North Korean state-sponsored actors; available evidence did not support definitive attribution to a particular cluster.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Главной находкой исследователи считают бэкдор Ted, встроенный в модифицированную сборку балансировщика HAProxy.
Главной находкой исследователи считают бэкдор Ted, встроенный в модифицированную сборку балансировщика HAProxy.
Главной находкой исследователи считают бэкдор Ted, встроенный в модифицированную сборку балансировщика HAProxy.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
“Command-and-control (C2) requests are erased from HAProxy's connection counters, leaving no trace in backend logs or load balancer statistics.”
It then strips the keywords tmp, wget, cron and crond from root's bash history.
It is possible for the implant to observe HTTP traffic while the server is performing normal load-balancing activities. It is possible to monitor high-value web requests, capture session cookies, and identify certain clients for traffic manipulation using the backdoor.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux-бэкдор, внедренный в пересобранный HAProxy. Активируется специальным HTTP-запросом и скрытно перехватывает C2-команды на уровне балансировщика, не направляя их в бэкенд, журналы или статистику HAProxy. Позволяет выполнять shell-команды, передавать файлы, менять конфигурацию и выборочно внедрять скрипты в веб-страницы для watering-hole, кражи сессий и учетных данных либо drive-by-атак.
A Linux HAProxy implant/backdoor bundled with HAProxy 2.8.12. It abuses HAProxy internals—including its filter API, memory pools, event scheduler, and process management—to blend into legitimate load-balancer operation. It monitors selected HTTP traffic, captures session cookies, injects malicious scripts into responses, and receives concealed C2 commands through specially crafted image-path requests without forwarding them to backend servers or normal HAProxy connection accounting.
A backdoor attributed in the post title to DPRK APT activity targeting South Korean media and automotive sectors.
A Linux HAProxy implant that intercepts HTTP traffic, filters requests by User-Agent, URL, referrer patterns, and client IP address, and selectively serves modified content. It conceals its activity by erasing C2 requests from HAProxy connection counters and manipulating HTTP headers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.