Loading malware…
Ted backdoor is a Linux-based server implant embedded as a custom plugin in a trojanized HAProxy 2.8.12 build. It integrates with HAProxy’s native filtering, HTTP parsing, memory-management, scheduling, and process infrastructure, allowing the load balancer to continue normal operations while covertly inspecting decrypted HTTP traffic. The implant provides an HTTP-based command channel supporting remote command execution, beaconing, configuration updates, and file transfers. It can selectively collect request metadata and web-session cookies, and can modify responses for operator-selected visitors by injecting scripts, replacing content, or redirecting traffic. Selection criteria include network-source and browser characteristics as well as hidden request values.
Ted backdoor suppresses forensic evidence by preventing command traffic from reaching backend applications and manipulating HAProxy telemetry and response handling to conceal anomalous traffic and altered content. It has been observed as part of a long-term Linux espionage toolkit also involving CurlRAT, trojanized Linux services, and SSH credential-capture tooling. Activity targeted South Korean automotive and media-sector organizations. The operation has been assessed with medium confidence as linked to DPRK-aligned threat activity; available evidence does not conclusively attribute the implant to a specific DPRK threat cluster.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
CurlRAT executes command lists via popen and supports reverse and interactive PTY shells; ted executes commands via popen.
The implants use pthread_create/pthread_detach and HAProxy internal allocation and task-scheduling APIs.
“The campaign uses social engineering and malicious files to establish access and deploy malware...”
The malware then saves the command in a named pipe and removes traces of the request from HAProxy’s internal counters.
The “ted backdoor” is compiled directly into HAProxy’s own source code as a custom plugin, using the software’s native filter API, internal memory management, and event scheduler to intercept HTTP traffic while completely legitimate load balancing keeps running normally.
The targeting pattern, simple XOR-based encryption, a custom substitution cipher, and command-server infrastructure already linked to APT37 by other threat intelligence feeds all point toward North Korean state involvement.
Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform's static-content naming style.
The ted backdoor is compiled into HAProxy and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.
Beyond remote command execution, the backdoor can quietly inject malicious scripts or entirely swap out page content for specific victims matched by IP address, browser fingerprint, or even a hidden authentication credential smuggled inside the Accept-Language header.
“...deploy malware capable of command execution, system reconnaissance, and data theft.”
Beyond remote command execution, the backdoor can quietly inject malicious scripts or entirely swap out page content for specific victims matched by IP address, browser fingerprint, or even a hidden authentication credential smuggled inside the Accept-Language header.
The attackers send a request for a fake image at /favorite_list_2x_m500_ico.jpg. This switches the HAProxy filter into command-and-control mode.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A deeply integrated HAProxy backdoor compiled into the load balancer as a custom filter. It activates C2 via requests for a fake image path, suppresses evidence from HAProxy counters and backend/application logs, executes remote commands, and can inject or replace web content for selectively targeted visitors. It supports credential and cookie-session theft, redirects, drive-by-download activity, and long-term surveillance.
A custom HAProxy-resident backdoor that intercepts and injects HTTP traffic, executes C2 tasks and remote commands, exfiltrates data, supports persistence, steals cookie sessions and credentials, redirects selected users, and conceals tampered content from specified IP ranges.
Custom backdoor used in a DPRK-linked espionage campaign; it is deployed through social engineering and malicious files to establish access and supports command execution, system reconnaissance, and data theft.
A Linux/HAProxy implant embedded in a modified HAProxy 2.8.12 load balancer. It inspects decrypted web requests, steals session cookies and selected request data, executes commands, transfers files, and selectively injects malicious scripts into served pages. It uses an image-like request path for its covert command channel and manipulates HAProxy connection counters to reduce visibility.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.