Ted Backdoor Implant in Trojanized HAProxy Binaries

A previously undocumented Linux toolkit, identified by researchers as 'ted', has been discovered compiled directly into trojanized HAProxy load balancer binaries. This threat involves the replacement of legitimate binaries (including HAProxy 2.8.12, agetty, atd, and polkitd) on compromised Linux servers in South Korea. The implant functions as a stealthy interceptor that monitors inbound web traffic for specific URL and referer patterns, serving altered pages to selected targets.

When triggered, the ted implant decrements HAProxy connection counters to prevent C2 traffic from appearing in backend logs or load balancer statistics. C2 communication occurs over raw sockets using standard HTTP/1.0 200 OK headers, allowing the operator to beacon, manage files, and execute shell commands. The toolkit also includes a trojanized sshd for password harvesting and employs rigorous anti-forensic measures, including the scrubbing of bash history and tampering with system logs (auth.log and audit/audit.log). Because this is a binary-level compromise rather than a software vulnerability, upgrading the application does not remediate the threat.

Attack Chain

1. Attacker gains initial code execution on a Linux host, likely through exploitation of a portal or service (e.g., groupware).
2. Attacker verifies root privileges to facilitate the replacement of core system binaries.
3. Attacker replaces legitimate system binaries (HAProxy, crond, sshd, agetty, atd, polkitd) with trojanized versions containing the ted toolkit.
4. Attacker forces the timestamp of the new crond binary to match the existing /usr/bin/ssh file to evade basic integrity monitoring.
5. The implant intercepts incoming web traffic, checking for specific User-Agent, URL, and Referer patterns before serving malicious content.
6. The implant writes C2 command bodies to a named pipe under /tmp and erases the request channel, ensuring no evidence reaches application logs.
7. Attacker executes further commands, beacons, or steals plaintext credentials via the trojanized sshd component.
8. Anti-forensic routines strip keywords like 'tmp', 'wget', and 'cron' from bash history and system logs to hide operational activity.

Impact

This campaign targets organizations in South Korea's automotive and media sectors. Successful exploitation allows for the covert interception and modification of web traffic, remote command execution, and the harvesting of plaintext credentials. As of September 2026, the activity has been linked to North Korean state-sponsored clusters, with defenders noting that the custom nature of the binary replacement and anti-forensic measures makes detection highly challenging without advanced binary integrity or memory analysis.

Recommendation

Prioritized actions for detection engineering:

• Perform binary integrity checks on critical system binaries (/usr/sbin/haproxy, /usr/sbin/sshd, /usr/bin/agetty) and compare hashes against known-good vendor builds.
• Implement memory behavioral analysis to detect the presence of injected code or anomalous socket manipulation that circumvents standard connection logging.
• Audit system logs and bash history for missing time gaps or systematic deletion of keywords associated with the ted implant (e.g., 'tmp', 'wget', 'cron').
• Monitor for the creation of anomalous named pipes in /tmp and suspicious files identified in the IOC section, such as /tmp/jasper-log.
• Given that HAProxy 2.8.12 is explicitly targeted, audit all internet-facing load balancers for unauthorized binary modifications regardless of reported version strings.