HAProxy Turned Trojan: North Korean APT Weaponizes the Load Balancer

Rapid7 Labs published its analysis on September 3, 2026, of a previously undocumented Linux toolkit — dubbed ted backdoor and curlRAT — deployed in cyber-espionage campaigns against South Korean automotive and media organizations. The earliest samples date to mid-2025; the build is based on HAProxy 2.8.12-0fdb194, released November 22, 2024. Source-level integration into the edge load balancer's code marks a significant evolution in tradecraft: the traffic transit infrastructure itself becomes the point of compromise, not merely the final target.

How the Load Balancer Became the Watering Hole

The decision to trojanize HAProxy rather than drop an add-on component reveals a design optimized for longevity and stealth. The ted backdoor does not merely load into the process; it is compiled as part of the binary itself, inheriting the host program's memory management and scheduling structures. This allows it to intercept traffic in transit without generating process anomalies or suspicious connections that a typical EDR would flag.

Victims analyzed by Rapid7 exposed ports 80, 443 (Groupware portal) and 25 (mail server). Initial access remains unconfirmed; the source assesses exploitation of RCE vulnerabilities in mail servers as plausible, consistent with documented Kimsuky tradecraft, or in the Groupware portal. Insufficient forensic evidence prevents establishing a complete timeline or identifying a specific CVE.

Toolkit Architecture: Stager, RAT, and Keylogger

The compromise chain unfolds in multiple stages. The initial stager verifies root privileges, gathers system information, and selects the appropriate payload. The profiling mechanism covers hostname, OS distribution, kernel version, and CPU architecture. Explicit support for CentOS 7.7, 7.8, 7.9 and Ubuntu 22.04 indicates targeting of established enterprise infrastructure, not cloud-native or containerized environments.

Persistence is achieved by overwriting legitimate system binaries — crond, sshd, agetty, atd, polkitd — with trojanized versions. Timestomping aligns the compromised binary's timestamp with that of /usr/bin/ssh, defeating integrity checks based on temporal anomalies. Selective log deletion completes the cover-up.

curlRAT implements six C2 commands (0-5) managed via jump table: command execution, configuration writing, additional payload drop, reverse shell, and other operational functions. The command-and-control channel relies on two domains: img.monderhouse.space (primary) and img.darklights.store (fallback). Authentication uses an api_token with value ecd427ea8330a4ff73618483e00b9b41 and a User-token header containing the victim identifier. The retry loop allows five attempts at five-second intervals; the command output buffer is sized at 1 MB.

The Detection Problem with Timestomped Binaries

System binary integrity represents the weak point exposed by this campaign. When compromise occurs at the executable file level with deliberate timestamp alignment, traditional indicators of compromise — known hashes, timestamp anomalies, unusual child processes — lose effectiveness. The compromised crond binary spawns no foreign processes: it is crond itself executing malicious code.

The SSH keylogger adds a credential-harvesting layer, saving data to /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 with a custom encryption based on a substitution cipher and base64. The choice of weak encryption suggests the priority is evasion of automated analysis tools rather than resistance to thorough manual examination.

"The ted backdoor is compiled as part of the victim's existing HAProxy version 2.8.12. It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected." — Rapid7 Labs

Why This Matters

The dossier does not specify remediation measures or explicit countermeasures provided by the HAProxy vendor, nor operational guidance for remediation. The source also does not document whether the toolkit is used exclusively by a single North Korean APT or shared among multiple groups, nor does it establish a precise victim count beyond the two organizations analyzed.

The campaign highlights how the attack perimeter has shifted from web servers to traffic transit nodes. A compromised load balancer exposes not only the infrastructure hosting it, but all clients and users passing through it — a distributed watering hole no longer limited to a single site. The source-level backdooring technique also makes verification of the software supply chain for installed software a control that can no longer be deferred.

Rapid7's attribution to "DPRK-nexus actors" rests on tradecraft overlaps, not direct infrastructure evidence. No C2 infrastructure overlaps currently link the toolkit with certainty to Kimsuky, Lazarus, or Andariel.

Questions and Answers

Organizations managing HAProxy load balancers, particularly in the geographies and sectors indicated by the source, must now verify the integrity of their binaries against a threat that leaves no obvious behavioral traces. The shift from server compromise to transit-node compromise marks a reconfiguration of risk that traditional perimeter defense models do not cover.

Sources

• https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors
• https://ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-attacks-on-industrial-organizations-in-h1-2023/#korean-speaking-activity

Information is based on the cited source and current as of publication.

Sources