New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.
- ted implant compiled into victims' HAProxy builds, requiring prior code execution, not a HAProxy flaw
- C2 hidden by decrementing HAProxy connection counters; responses disguised as HTTP/1.0 200 OK pages
- Toolkit trojanizes crond, sshd, agetty, atd, polkitd; curlRAT beacons every 12 hours by default
- Six C2 domains overlap APT37 entries in maltrail; medium-confidence DPRK attribution
- Victims in South Korea's automotive and media sectors
- Products
- HAProxy
- Threat actors
- APT37Lazarus GroupKimsuky
- Countries
- North KoreaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cleanos.online | in.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online and app.cleanos[.]online. Rapid7 has not said whether the |
| domain | darklights.store | erhouse[.]space Domain - img.smartnords[.]site Domain - img.darklights[.]store Domain - img.responsive.pstatic[.]autos Domain - img.soci |
| domain | grip-cdns.space | but not in Rapid7's list: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online and app.cleanos |
| domain | monderhouse.space | he following indicators of compromise (IoCs) - Domain - img.monderhouse[.]space Domain - img.smartnords[.]site Domain - img.darklights[.] |
| domain | primgs.lol | in the same two maltrail entries but not in Rapid7's list: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.] |
| domain | pstatic.autos | ite Domain - img.darklights[.]store Domain - img.responsive.pstatic[.]autos Domain - img.socialteams[.]store Domain - img.worksongo[. |
| domain | smartnords.site | mise (IoCs) - Domain - img.monderhouse[.]space Domain - img.smartnords[.]site Domain - img.darklights[.]store Domain - img.responsive.p |
| domain | socialteams.store | ]store Domain - img.responsive.pstatic[.]autos Domain - img.socialteams[.]store Domain - img.worksongo[.]store File - ~/cache/haproxy-100 |
| domain | worksongo.store | tatic[.]autos Domain - img.socialteams[.]store Domain - img.worksongo[.]store File - ~/cache/haproxy-1000.cache File - /var/lib/sshd/c8 |
| md5 | c8c68e629bba773a10ac80012d10bf19 | tore File - ~/cache/haproxy-1000.cache File - /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 File - /var/lib/snapd/g580 File - /tmp/jasper-log SHA-256 - |
| sha256 | 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 | 9142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5 The Hacker News confirmed on September 4 that none of the s |
| sha256 | 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 | File - /var/lib/snapd/g580 File - /tmp/jasper-log SHA-256 - 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 SHA-256 - 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1 |
From the original article
5 min read at thehackernews.com
A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.