An undocumented Linux toolkit was compiled directly into trojanized HAProxy load balancers of two South Korean organizations, intercepting web traffic and serving altered pages to selected visitors. The implant, named ‘ted’ in debug strings, is not a HAProxy flaw but requires host‑level code execution to install.
- ‘Ted’ backdoor discovered inside HAProxy builds of two Korean firms
- Intercepted traffic and served modified web pages to targeted visitors
- Not a HAProxy vulnerability; requires prior code execution on the host
Discovery Narrative
Security researchers at BozokMedia recently uncovered an unknown Linux toolkit that had been compiled directly into the HAProxy load balancers of two South Korean entities. Debug strings within the binary revealed the implant’s name – “ted” – indicating a deliberate backdoor identifier used by the attackers.
Technical Mechanics
The toolkit was inserted by modifying HAProxy’s source and recompiling it as a trojanized binary. Once the service starts, the backdoor activates, sniffing network packets, identifying specific user‑agents or IP ranges, and delivering forged web pages. Crucially, the attack does not exploit a native HAProxy flaw; it assumes the adversary already has the ability to execute code on the host system.
Impacted Organizations
While the exact names remain undisclosed, the victims operate in South Korea’s financial and e‑commerce sectors. Affected users reported seeing altered advertisements and phishing‑style pages while browsing what appeared to be legitimate sites, raising the risk of credential theft.
Global Implications
HAProxy powers millions of websites worldwide as a high‑performance load balancer. A backdoor of this nature, if proliferated, could undermine the trustworthiness of internet traffic on a massive scale. Experts warn that supply‑chain attacks of this type are likely to become more common.
Historical Background
In the past five years, HAProxy has been the target of several attacks, most of which leveraged known software bugs. A notable 2020 supply‑chain incident demonstrated how malicious code could be injected into otherwise legitimate binaries. The “Ted” implant pushes this trend further by relying on pre‑existing host code execution privileges.
Why This Matters
BozokMedia analysis shows that compromising a ubiquitous component like HAProxy gives attackers a stealthy foothold across diverse industries, making detection extremely challenging and amplifying the potential damage.
"Compromising HAProxy provides a silent, high‑impact vector; this backdoor could force a rethink of infrastructure security strategies," notes cyber‑security specialist Dr. Lee Sung‑Hyun.
Frequently Asked Questions
Q1: Is this backdoor present in any official HAProxy release?
A: No, it was found only in two custom‑compiled binaries that were tampered with by the attackers.
Q2: What steps should organizations take to protect against such attacks?
A: Verify the integrity of HAProxy binaries, increase monitoring for unauthorized code execution, and harden the software supply chain.
