As reported by SecurityAffairs, Rapid7 Labs has documented a North Korean threat actor embedding a custom backdoor — dubbed "ted backdoor" — directly into HAProxy 2.8.12 source code at two South Korean organizations in the automotive and media sectors. This is not a typical post-compromise implant. It is a weaponized fork of a critical infrastructure component, compiled with the target's own HAProxy version and woven into its native filter API, memory pools, and event scheduler.

Threat Intelligence: As reported by SecurityAffairs, Rapid7 Labs has documented a North Korean threat actor embedding a custom backdoor — dubbed "ted backdoor" — directly into HAProxy 2.8.12 source code at two South Korean organizations in the automotive and media sectors.

Why This Campaign Breaks the Detection Playbook

Most detection frameworks assume malicious activity manifests as new processes, unusual network connections, or filesystem artifacts that deviate from a known-good baseline. The ted backdoor inverts every one of those assumptions:

Why This Campaign Breaks the Detection Playbook
No new process: The implant lives inside the HAProxy process itself, using its legitimate threading and event loop.
No backend log trail: C2 commands arrive as a request for a fake image file (/favorite_list_2x_m500_ico.jpg), are intercepted by the filter, and never forwarded to backend servers. Application logs are blind.
No HAProxy counter anomaly: The backdoor scrubs internal HAProxy statistics and forwarding buffers after receiving each command, so even HAProxy's own monitoring output shows no trace.
Deeper persistence: Trojanized versions of crond, agetty, atd, sshd, and polkitd suggest rootkit-level persistence across multiple system daemons, not just the load balancer.

The result is an implant that is invisible to application-layer monitoring, invisible to load balancer self-monitoring, and visible only at the network layer if defenders are specifically examining edge device egress for anomalous C2 patterns — which most organizations are not configured to do.

Why the Network Edge Is the Perfect Hiding Spot

HAProxy and similar reverse proxies occupy a privileged position in the trust model: they terminate TLS, inspect HTTP headers, and sit between untrusted internet traffic and the application tier. Security teams typically invest heavily in monitoring east-west traffic and endpoint EDR but treat the load balancer itself as trusted infrastructure — a static component that "just works." This campaign exploits that trust gap precisely.

By compiling the backdoor into HAProxy's source rather than deploying it as a runtime-injected module or separate process, the attackers gained the ability to intercept cleartext HTTP traffic after TLS termination — including credentials, session tokens, and API keys — before it ever reaches the application. This is a man-in-the-middle position built into the infrastructure itself.

The ted backdoor doesn't sit beside HAProxy. It IS HAProxy — and that distinction renders most endpoint and SIEM detection rules irrelevant.

Broader Implications

This campaign signals a maturation in DPRK tradecraft toward infrastructure-layer supply chain compromise rather than endpoint-focused malware. The approach is reusable against any organization that compiles HAProxy from source — and the blueprint is adaptable to other open-source edge components like NGINX, Envoy, or Traefik. We should expect other nation-state and financially motivated groups to study and replicate this technique.

The targeting of South Korean automotive and media sectors aligns with known DPRK intelligence priorities: technology exfiltration for sanctions evasion and revenue generation, plus media sector monitoring for information control purposes.

Shield53 Recommendations

Immediate Actions

  • Verify binary integrity: For any HAProxy deployment compiled from source, compare the running binary hash against a clean compilation of the same version from the official HAProxy Git repository. Any mismatch requires immediate forensic investigation.
  • Network-layer C2 detection: Deploy IDS/SIEM rules flagging HTTP requests to /favorite_list_2x_m500_ico.jpg arriving at HAProxy listener IPs. Also monitor for outbound connections from load balancer hosts that do not match expected backend communication patterns.
  • Audit named pipes: The ted backdoor uses named pipes for command passing. Enumerate and investigate unexpected FIFO files on all reverse proxy and load balancer hosts.
  • Review build pipelines: If your organization compiles HAProxy from source through a CI/CD pipeline, audit the build environment for compromise. A supply chain attack at the build stage would affect every downstream deployment.
  • Detect trojanized daemons: Compare checksums of crond, agetty, atd, sshd, and polkitd against package manager records. Any mismatch on edge infrastructure hosts should be treated as a potential compromise indicator.

Strategic Hardening

  • Prefer package-manager-installed HAProxy binaries over self-compiled builds where feasible, and enable tamper detection (e.g., AIDE, rpm --verify, debsums) on all edge infrastructure.
  • Implement network segmentation between load balancers and the internet such that HAProxy hosts cannot initiate arbitrary outbound connections — only respond to inbound and forward to defined backends.
  • Deploy eBPF-based runtime monitoring (e.g., Falco, Tetragon) on load balancer hosts to detect in-process anomalous behavior that traditional process-based EDR will miss.
  • Establish a baseline of normal HAProxy egress traffic and alert on deviations — particularly any outbound connection from the HAProxy process to non-backend destinations.