"ted" Backdoor in HAProxy: Load Balancer Turned Spy in South Korea

Rapid7 Labs published its analysis on September 3, 2026, of a previously undocumented Linux toolkit active against edge servers in South Korea. At the core of the operation is ted, a statically compiled backdoor embedded inside HAProxy 2.8.12 that exploits the load balancer's internal APIs to intercept and manipulate traffic without disrupting legitimate service. Alongside ted operates curlRAT, a remote access tool that maintains the connection to the attackers' infrastructure and manages the deployment of additional payloads.

The identified targets belong to the automotive and media sectors. The earliest traces on VirusTotal date back to mid-2025, but the investigation's publication date — set in 2026 — raises questions about the exact timeline that Rapid7 itself does not clarify.

How ted Nests in the Heart of HAProxy

The technique is a "ghost in the machine": no additional process is installed; the malware becomes the existing process. According to Rapid7 Labs, "the ted backdoor is compiled as part of the victim's existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected". The build involved, HAProxy 2.8.12-0fdb194, was released on November 22, 2024: this is the earliest possible compilation date for the backdoor.

The result is a threat nearly invisible to perimeter controls. The load balancer, by definition, handles all inbound traffic. If the load balancer itself is compromised, network segmentation loses meaning: the attacker sees requests before they reach any other control. File-signature detection — hashes of known binaries, YARA rules on disk — fails because the binary is the legitimate one, recompiled with added functionality.

The Compromise Chain: From Groupware Portal to System Binaries

Rapid7 has partially reconstructed the kill chain. Victim servers exposed ports 80 and 443 for Groupware portals, and port 25 for mail servers. Initial access is unconfirmed: "the specific entry point and any associated CVE remain unconfirmed pending further forensic evidence", and "gathered evidence does not suffice to establish a timeline nor how the initial access was performed". The contextual hypothesis — unproven — points to a known pattern of Kimsuky, a North Korean APT that has historically exploited RCE vulnerabilities in South Korean groupware software.

Once on the system, the actor replaces critical binaries with trojanized variants. The compromised crond receives timestomping to align with the timestamp of /usr/bin/ssh. The encryption is custom: a substitution cipher for harvested SSH credentials, single-byte XOR for configuration strings, shared across polkitd, crond, agetty, and atd. Log cleaning is selective and targeted: it filters keywords such as tmp, wget, cron, and crond from /root/.bash_history and logs in /var/log/, using a staging file in /tmp/jasper-log.

curlRAT: The Remote Control with Built-in Watchdog

The second component, curlRAT, serves as the operational interface with the command-and-control infrastructure. The identified C2 domains are img.darklights.store and img.monderhouse.space. Communication occurs via HTTPS with token-based authentication. The RAT implements six command modes (0-5): command execution via popen with a 1 MB output buffer, configuration writing, staged payload drop, reverse shell, and two modes not fully described in the truncated analysis text.

A relevant technical detail: curlRAT maintains a watchdog thread dedicated to monitoring HAProxy's health. As Rapid7 documents, "the RAT maintains a watchdog thread dedicated to tracking HAProxy's health, and reporting it back to the operator's infrastructure". This mechanism suggests that the legitimate service's availability is an operational constraint for the attackers: a down or unstable load balancer would be detected, interrupting collection. The stager's logic reinforces this dependency: it verifies the presence of HAProxy or cron before proceeding with deployment, adapting the payload to the detected context.

"The earliest uploads on VirusTotal date back to mid-2025 and the involved HAProxy 2.8.12-0fdb194 was released on 22 November 2024, establishing this as the earliest possible compilation date for this build." — Rapid7 Labs

The Shadow of Kimsuky and the Limits of Attribution

Rapid7's dossier positions the toolkit within the broader North Korean threat ecosystem. Kaspersky, in a 2023 report on Lazarus and Kimsuky TTPs, documented similar patterns: watering holes on industrial portals, backdooring of legitimate software, targeting of strategic sectors in South Korea. However, no confirmed infrastructural overlap links ted/curlRAT to a specific group. Attribution to Kimsuky remains contextual, plausible but unproven.

The historical context serves to legitimize the pattern, not to identify the author. The only tangible attribution datum in the dossier — a North Korean IP address accidentally exposed in previous operations — comes from the Kaspersky report on Lazarus, not from this incident. Rapid7's methodological caution on this point is explicit and must be respected.

Why This Matters

The source does not specify remediation measures nor provide official patches or workarounds. The brief does not document operational recommendations from Rapid7 for mitigating ted/curlRAT. The nature of the compromise — a legitimate binary recompiled — renders any verification based solely on vendor reference hashes inadequate. The dossier also does not clarify whether HAProxy 2.8.12-0fdb194 was distributed via official repositories, third-party repositories, or through direct compromise of the build process in victim organizations.

The source does not specify the nature of the data exposed or intercepted through the backdoor. It does not emerge how many servers are actually compromised, nor the duration of individual intrusions. The completeness of C2 modes 4 and 5 is partial due to truncated text in the original analysis.

The reported publication date — September 3, 2026 — is not independently verified and may contain a system error or a scheduled date.

What remains documented is sufficient to signal a qualitative leap in concealment technique: when the perimeter security infrastructure itself becomes the espionage vehicle, traditional detection models — east-west traffic analysis, endpoint monitoring, log correlation — lose their anchor point. Malicious traffic is indistinguishable from legitimate traffic because it transits through the same process, the same sockets, the same TLS certificates.

Questions the Dossier Leaves Open

Information is based on the cited source and current as of the time of publication.

Sources

• https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
• https://ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-attacks-on-industrial-organizations-in-h1-2023/#korean-speaking-activity