A previously unknown Linux toolkit has been discovered embedded directly inside trojanized HAProxy load balancers at two South Korean organizations, where it intercepted web traffic and delivered altered pages to selected visitors, according to a report published Friday by Rapid7 Labs. The attackers labeled the implant "ted" in debug strings left inside the binary. Rapid7 attributed the toolkit with medium confidence to North Korean state-sponsored actors and placed the two victims in South Korea's automotive and media sectors.
The implant operates by intercepting command-and-control requests before they reach a backend server and erasing them from HAProxy's own connection counters, so neither backend logs nor the load balancer's statistics record the activity. A request for one specific image path activates the filter into C2 mode, the report states. The implant decrements HAProxy's live connection counters, dropping the connection from statistics, and writes the command body to a named pipe under /tmp. Output returns on the raw socket under a standard HTTP/1.0 200 OK header, making the exchange resemble ordinary web traffic. Through that channel, operators can beacon, upload and download files, run shell commands, and replace the implant's configuration. Only requests clearing four checks receive a modified page: the request must carry a User-Agent and match a rule whose URL and referer patterns both fit, then delivery falls to either whitelist membership on the client address or an operator key in the Accept-Language header that overrides address filtering entirely. Both victims ran HAProxy 2.8.12, released November 8, 2024, and the implant reads HAProxy's internal structures at offsets fixed to that release. The current release on that branch is 2.8.28 from August 27, 2026—16 point releases later—and HAProxy's tracker lists 529 known bugs affecting 2.8.12 that are already fixed, including one critical and 16 major.
"Further evidence is necessary to make a more definitive assessment," Rapid7 said. The report notes that its evidence wasn't enough to establish a timeline or determine how the attackers first gained access. Its hypothesis that they entered through an exposed Groupware portal—a class of Korean enterprise collaboration software—rests on ENKI research documenting Kimsuky compromising a groupware vendor through a mail server flaw. The stager deploys only where HAProxy or cron is already running and verifies root before dropping anything. It overwrites the legitimate crond binary and gives the replacement the creation timestamp of /usr/bin/ssh, then strips keywords tmp, wget, cron, and crond from root's bash history and from six system logs, among them auth.log and audit/audit.log. A trojanized sshd in the same toolkit encrypts captured plaintext passwords and writes them to a fixed path, and Rapid7 found the same code in trojanized agetty, atd, and polkitd binaries.
The report explains that this isn't a HAProxy vulnerability—installing the implant requires code execution on the host and the ability to replace the running binary. Rapid7 compared the delivery model to Operation SyncHole, in which visitors to South Korean online media sites were filtered by a server-side script and redirected, with Kaspersky assessing "with medium confidence" that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper. The attribution passage draws on three separate North Korean clusters: APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Mandiant's 2023 assessment of North Korean cyber structure recorded shared tooling and overlapping targeting across those clusters, noting "this will make precise attribution more difficult." Rapid7 recommended independent network correlation, memory behavioral analysis, and binary integrity checks, though upgrading doesn't clean a host the implant already sits on because the attackers replace the binary rather than exploit a flaw in it. The development arrives as AhnLab and ENKI WhiteHat documented a similar watering-hole campaign in July, in which state-sponsored operators abused compromised Korean websites to attack the AnySign4PC signing client. Organizations running older HAProxy builds face twin risks—both from the implant itself if already present and from hundreds of unpatched bugs that create separate attack surfaces—while detection demands techniques that look beyond version strings to actual binary behavior.