Cybersecurity researchers at Rapid7 have documented one of the most architecturally sophisticated North Korean espionage toolkits seen to date: a previously undocumented Linux framework that embedded itself directly into the HAProxy load balancer binaries of two South Korean organizations and operated undetected for an estimated nine to ten months — not by exploiting a vulnerability in HAProxy, but by replacing the legitimate binary entirely and using the application’s own internal infrastructure to erase all evidence of its activity. The firm published its full technical analysis on September 4, 2026.

The toolkit, named “ted” after debug strings left in the binary by its operators, exploited a structural reality of modern web architecture: the load balancer is the SSL/TLS termination point, which means it decrypts every HTTPS connection before forwarding traffic to backend servers. Once the ted plugin was compiled into HAProxy and operational, the attackers could read, alter, and log all decrypted web sessions passing through it — without touching a single backend server, and without leaving any entry in HAProxy’s own connection statistics or logs.

Rapid7 attributed the campaign with medium confidence to DPRK-aligned threat actors, noting overlaps with both APT37 (also known as Ricochet Chollima, operating under North Korea’s Ministry of State Security) and the Lazarus Group (operating under the Reconnaissance General Bureau). The victims were in South Korea’s automotive and media sectors — industries with proximity to defense-adjacent supply chains and high-value intellectual property.

When SSL Termination Becomes a Wiretap

The architectural insight at the center of this campaign is not widely appreciated in enterprise security monitoring: load balancers that handle SSL/TLS termination decrypt incoming HTTPS connections before passing plaintext HTTP to backend servers. This is standard, necessary, and broadly deployed — HAProxy is used by GitHub, Reddit, Stack Overflow, Booking.com, and Uber, among thousands of organizations tracked by independent market analysts. It is also the reason why a threat actor with binary-level control of a load balancer is positioned to read every authenticated session, form submission, and API token that passes through it, regardless of HTTPS.

The ted backdoor was compiled directly into HAProxy version 2.8.12 using its native filter API — a legitimate extensibility mechanism designed to allow custom code to intercept and process HTTP streams. By registering a custom filter through HAProxy’s own plugin system, the ted_plugin hooks the HTTP parser at the point where decrypted traffic flows through the application’s internal buffer (the HTX buffer), giving operators read and write access to every request and response body in plaintext — including content that users believed was protected by HTTPS.

This is not a design flaw in HAProxy. The filter API is working as intended. The exploitation is the binary replacement itself: an attacker who can install a recompiled version of a trusted application inherits all of that application’s privileges and architectural roles, including its role as the decryption boundary.

Invisible to HAProxy’s Own Logs

What makes the ted backdoor technically exceptional is the method by which it hides command-and-control activity from monitoring tools that rely on HAProxy’s own statistics.

When an operator sends a command to the implant via a specially crafted HTTP request to the path /favorite_list_2x_m500_ico.jpg, the ted plugin intercepts the request before it reaches any backend server. It then directly modifies HAProxy’s internal connection counters — atomically decrementing the per-backend and global connection fields (beconn, feconn, actconn, cum_conn, cum_req, bytes_in, bytes_out) as well as the peak metrics — using hardcoded struct offsets fixed to version 2.8.12. The result: the connection never appears in HAProxy’s own statistics or backend logs. The C2 response returns on the raw socket disguised as a standard HTTP/1.0 200 OK response.

Any SIEM or monitoring system that correlates frontend traffic statistics with backend server logs to detect anomalies is, by design, blind to this class of activity. The load balancer is trusted to report honestly. It does not.

Attack Chain: Edge to Interior

Rapid7 was unable to definitively confirm the initial access vector, but the available evidence points toward exploitation of an externally exposed Groupware login portal (a category of Korean enterprise collaboration software common to both victim environments), with the mail server on port 25 as an alternative plausible vector. Since early 2026, ENKI WhiteHat has documented Kimsuky exploiting remote code execution vulnerabilities in externally accessible mail servers to compromise South Korean groupware vendors.

Once inside the edge server, the threat actor deployed an SSH keylogger that intercepted plaintext passwords and wrote them to an encrypted file at a fixed path, establishing a credential-harvesting foothold for lateral movement into the victim’s internal network.

From there, a stager deployed the second major component: curlRAT, a curl library-based remote access trojan embedded inside the trojanized crond daemon. The stager was selective — it deployed only on hosts where HAProxy or cron were already running, verified root privileges first, and then overwrote the legitimate crond binary and gave the replacement the same filesystem timestamp as /usr/bin/ssh to blend in with native system binaries. Log traces were methodically erased: the stager stripped keywords including “wget,” “cron,” and “crond” from bash history, audit logs, syslog, and auth.log using a staging file named /tmp/jasper-log — likely chosen to blend in as a JavaServer Pages engine artifact.

On the edge server itself, the trojanized HAProxy binary was installed and the ted backdoor was activated, completing a two-node compromise: the edge load balancer intercepting and altering web traffic for end users, while the internal servers ran curlRAT awaiting commands from the same operator infrastructure.

CurlRAT: Six Modes, Long-Term Persistence

CurlRAT — named by Rapid7 for its use of the libcurl library for all network communications — is distinct from CurlBack RAT, a separate and unrelated malware family attributed to the Pakistan-linked SideCopy group. This one operates on a 12-hour polling interval by default, dropping to 30 seconds when operators activate fast-poll mode, and implements six operational modes accessed through a single-character command byte:

Command execution (mode 0) runs operator-specified shell commands via popen and streams output back over the C2 channel. Config update (mode 1) writes a new configuration payload to disk and resets C2 parameters. Payload dropper (mode 2) fetches files from the C2, decompresses them, and places them at a specified path. Reverse shell (mode 3) forces root privileges via setuid(0) and setreuid(0,0) before connecting out. Beacon (mode 4) transmits a 10-kilobyte system information package as a check-in. PTY shell (mode 5) opens a full interactive terminal session.

All communications use a feedback XOR cipher with Base64 encoding. Victim machines are identified by a unique token derived from hostname, IP address, hardware UUID, and cron version string — hashed with MD5 and converted to uppercase.

A second thread inside curlRAT acts as a dedicated HAProxy watchdog, polling the load balancer’s PID and process status every hour and reporting back to operator infrastructure. The operators were not simply maintaining access to the victim’s internal network: they were actively tracking the health of their primary implant on the edge server, categorizing its state as started, stopped, restarted, or reloaded.

Web Injection Engine: Serving Malicious Pages to Selected Targets

The ted backdoor’s web injection capability adds a watering-hole layer on top of the surveillance and C2 functions. When a user’s HTTP request matches the attacker’s targeting criteria — specific URL patterns, referrer strings, and user-agent signatures — the implant intercepts the server’s response and replaces or appends the page body with a decrypted malicious payload file before delivery.

The delivery is surgically selective. Four conditions must clear before injection occurs: the request must carry a matching user-agent; its URL and referrer must match an operator-configured regex rule; the client IP must either appear on a whitelist (checked at both the exact host and the /24 subnet level) or the request must carry a valid operator credential in the Accept-Language HTTP header — a field present in every standard browser request, making the traffic indistinguishable from normal web browsing.

To prevent detection, the implant strips the Accept-Ranges response header (so browsers cannot request byte ranges and detect a size mismatch), rewrites the Content-Length, and forces a 200 OK status on all modified responses — allowing payloads of arbitrary size to be substituted across multiple delivery passes using HAProxy’s own body-editing scheduler.

Infrastructure Mimicking Korean Web Platforms

The attacker’s delivery infrastructure follows a pattern consistent with DPRK operational conventions: six confirmed C2 domains registered under low-cost commodity top-level domains — .store, .space, .site, .autos — using subdomain schemes that mimic image-serving CDN endpoints. Most tellingly, one domain — img.responsive.pstatic.autos — closely mimics Naver’s pstatic.net static content domain, the major South Korean web platform’s CDN endpoint, providing camouflage for payload delivery traffic embedded in browsing sessions targeting Korean-language users.

As of September 4, 2026, The Hacker News confirmed that all six C2 domains now return NXDOMAIN — meaning no active infrastructure remains reachable. The domains are therefore primarily useful for retrospective log review rather than active blocking.

The six confirmed C2 domains are: img.monderhouse.space, img.smartnords.site, img.darklights.store, img.responsive.pstatic.autos, img.socialteams.store, and img.worksongo.store. Maltrail — an open-source detection project — lists an additional six domains under the same APT37 infrastructure entries, not included in Rapid7’s published IOCs: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online, and app.cleanos[.]online.

Attribution Across Three North Korean Clusters

Rapid7 attributes the campaign with medium confidence to DPRK APTs, drawing on three overlapping lines of evidence. The C2 domains are labeled as Ricochet Chollima (APT37) infrastructure by both ThreatFox and maltrail, with the maltrail entries timestamped July 2, 2025. The campaign’s watering-hole delivery model parallels Operation Code on Toast (documented as APT37) and Operation SyncHole (documented by Kaspersky as Lazarus Group, running November 2024 through February 2025), in which Lazarus compromised South Korean media sites to redirect visitors to pages serving malicious JavaScript. The initial access hypothesis — exploitation of an exposed groupware or mail server — is consistent with documented Kimsuky tradecraft reported by ENKI WhiteHat as recently as July 2026.

APT37 and the Lazarus Group operate under different DPRK agencies — APT37 under the Ministry of State Security, Lazarus under the Reconnaissance General Bureau — but a 2023 Mandiant assessment of North Korean cyber structure found significant shared tooling and overlapping targeting between the clusters, noting that this overlap “will make precise attribution more difficult.”

Within the ted binary itself, functions prefixed ngx_* — normally associated with nginx’s internal naming conventions — suggest possible code reuse from an nginx backdoor. Rapid7 observed similar naming in the Funnull campaign, in which a custom nginx filter was registered to hook HTTP traffic using simple XOR encryption, but found no code-level overlap sufficient to establish a stronger link.

What HAProxy Administrators Should Check Now

Upgrading HAProxy does not remove the ted backdoor. The attack replaces the legitimate binary on the host; upgrading the package installs a clean version from the repository, but the binary on disk may still be the trojanized one unless the upgrade is performed cleanly. Rapid7 recommends that defenders treat any edge component managing user traffic, SSL termination, or runtime modules with the same strict security standards applied to application servers — not lighter standards premised on the assumption that edge infrastructure is trustworthy by default.

Specific checks Rapid7 advises: verify HAProxy binary integrity against official SHA-256 release hashes (the current 2.8 branch release is 2.8.28, released August 27, 2026, which includes 529 bug fixes relative to 2.8.12); look for unexpected increases in binary size relative to a known-clean build; implement independent network-layer correlation that does not depend on HAProxy’s own log or statistics output; and apply memory behavioral analysis.

A critical caveat: a trojanized HAProxy binary reports the same version string (2.8.12-0fdb194) as a clean build. Version-string checks alone cannot detect this implant. Binary hash comparison against the official build is the only reliable method.

Rapid7 published a full set of indicators of compromise in its September 4 report, including SHA-256 hashes for the SSH keylogger, curlRAT stager variants, and the trojanized HAProxy binary (72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558). Earliest VirusTotal uploads for toolkit components date to mid-2025, establishing that the campaign was active for approximately nine to ten months before public disclosure.

Frequently Asked Questions

Can I detect the ted backdoor by checking my HAProxy version number?

No. A trojanized HAProxy binary compiled by the attackers reports the same version string — 2.8.12-0fdb194 — as a clean official build. Version-string checks are not a reliable detection method for this implant. The only reliable way to confirm binary integrity is to compare your installed HAProxy binary’s SHA-256 hash against the official hash published by the HAProxy project for version 2.8.12. Rapid7 also notes that the trojanized binary is larger than the official release, making file size comparison a supplementary check. Defenders should not rely on HAProxy’s own logs or statistics to confirm the absence of the implant, since the toolkit actively zeroes the connection counters through which C2 activity would otherwise appear.

If my load balancer is compromised like this, does HTTPS still protect my users?

Not fully, and this is the critical architectural point the ted campaign reveals. HAProxy performs SSL/TLS termination — it decrypts incoming HTTPS connections and forwards plaintext HTTP to backend servers. Once the ted plugin is running inside HAProxy, it operates after decryption, meaning it reads and alters fully plaintext web content. A user’s HTTPS connection to your domain provides no protection against an operator-controlled implant running inside the termination boundary. The TLS handshake verifies the connection to HAProxy; it cannot verify that the binary doing the decrypting has not been replaced.

How did North Korean actors use this toolkit without being noticed for nearly a year?

The ted backdoor was designed with evasion as its primary architectural principle. C2 commands were tunneled through a request to a path disguised as a static image file, terminating at the load balancer without ever reaching a backend server. The implant then zeroed HAProxy’s internal connection counters — the data structures that feed the load balancer’s own statistics — so the connection never appeared in monitoring dashboards or backend logs. Log-based intrusion detection systems that trust HAProxy’s self-reported statistics are structurally blind to this class of activity. Additionally, the trojanized crond binary was given the same filesystem timestamp as the legitimate /usr/bin/ssh, and system logs were scrubbed of keywords that would reveal the installation.

Does upgrading HAProxy to the current version remove this infection?

No. Upgrading HAProxy installs a clean binary from the package repository, but if the trojanized binary is already in place, it may persist depending on how the upgrade is performed and which binary paths are overwritten. More fundamentally, the curlRAT component runs inside the trojanized crond daemon — a separate binary entirely — and would not be affected by a HAProxy upgrade. Remediation requires verifying the integrity of every binary the toolkit is documented to have trojanized: HAProxy, crond, sshd, agetty, atd, and polkitd. Complete IOCs, including SHA-256 hashes for each component, are available in Rapid7’s September 4 technical report.