Ted implant turns compromised HAProxy builds into traffic interceptors

Rapid7 Labs has identified a previously undocumented Linux toolkit, named ted from debug strings in its binary, compiled into trojanized HAProxy load balancers at two South Korean organizations. The victims operate in the automotive and media sectors, and both ran HAProxy 2.8.12. The altered binaries intercepted web traffic, provided a command channel for operators and served modified pages to selected visitors.

Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, while stressing that further evidence is needed for a definitive assessment. The researchers said ted is not an HAProxy vulnerability: deployment requires code execution on the host and the ability to replace the running HAProxy binary.

A command channel outside normal backend visibility

A request for a specific image path switches the implant into command-and-control mode. Ted reduces HAProxy's live connection counters, writes the command body to a named pipe under /tmp and clears the request channel. The request therefore never reaches a backend server and is absent from backend logs and HAProxy statistics.

Responses return through the raw socket under a standard HTTP/1.0 200 OK header. Rapid7 said the channel supports beaconing, file upload and download, shell-command execution and replacement of the implant configuration. This design makes the exchange resemble ordinary web traffic while terminating it at the load balancer.

Selective page modification and broader host tampering

Modified content is delivered only after four checks. A request must include a User-Agent and match a rule with fitting URL and referer patterns. The client must then be on an approved address list, checked both exactly and at the /24 level, unless an operator key in the Accept-Language header bypasses address filtering.

The implant alters response content type and length, forces status 200 and removes the Accept-Ranges header, preventing byte-range requests that could expose a size change. Rapid7 also found related code in trojanized sshd, agetty, atd and polkitd binaries. The SSH component encrypts captured plaintext passwords and writes them to a fixed path.

A stager deploys only on hosts where HAProxy or cron is already running and verifies root privileges before acting. It overwrites the legitimate crond binary, gives it the creation timestamp of /usr/bin/ssh, and removes keywords including tmp, wget, cron and crond from root shell history and six system logs. A companion remote-access trojan, curlRAT, beacons every 12 hours by default, or every 30 seconds when an operator flag is set, and runs only when a marker file indicates virtualization.

Version updates do not remove a replaced binary

HAProxy 2.8.12 was released on November 8, 2024. The implant relies on internal-structure offsets fixed to that release, and Rapid7 did not state whether other 2.8 builds were affected. HAProxy 2.8.28, released on August 27, 2026, is 16 point releases newer; its tracker lists 529 known bugs affecting 2.8.12 that have been fixed in the branch, including one critical and 16 major issues.

Updating remains important, but it cannot clean a system where the HAProxy executable has already been replaced. Rapid7 recommends independent network correlation, memory behavioural analysis and binary-integrity checks. For businesses, the immediate implication is to verify load-balancer binaries against trusted builds, investigate anomalous HTTP traffic outside backend records, and treat patching as separate from host-compromise remediation.