'Ted' Backdoor Found Compiled Into Trojanized HAProxy Builds in South Korea

What Happened

Researchers identified a previously undocumented Linux toolkit, internally named ted by its operators (per debug strings left in the binary), compiled directly into trojanized HAProxy load balancer builds at two South Korean organizations. The implant intercepted web traffic passing through the compromised load balancers and served altered pages to selected visitors.

This is not a vulnerability in HAProxy itself. Deploying the backdoor required the attackers to already have code execution on the host and the ability to rebuild and redeploy a modified HAProxy binary — meaning prior compromise of the build or deployment pipeline, or direct host access, was a precondition.

Why It Matters

Load balancers sit at a uniquely privileged point in the network path, seeing and shaping traffic for every backend service behind them. A backdoor baked into the load balancer binary itself — rather than deployed as a separate implant — is harder to spot with traditional file-integrity or endpoint tooling that focuses on unexpected new binaries, since ted hides inside what looks like a legitimate, in-place HAProxy build. Any organization that compiles or distributes its own HAProxy (or similar edge/proxy software) builds internally should treat this as a supply-chain and build-integrity concern, not just an endpoint one.

What Defenders Should Watch For

• Verify HAProxy binaries against known-good hashes/checksums from upstream releases rather than assuming internally built binaries are trusted by default.
• Audit build pipelines and artifact repositories for unauthorized modifications to source or build scripts used to produce load balancer or proxy binaries.
• Hunt for anomalous outbound connections or unexpected content substitution/injection in web responses served through load balancers, particularly targeted at a subset of visitors rather than all traffic.
• Review host access logs on systems hosting load balancers for signs of the prior code-execution foothold that would have been required to plant the backdoor.
• Consider reproducible/verifiable build processes for critical infrastructure software to make silent binary tampering easier to detect.

This is developing intelligence based on a single reported campaign affecting two organizations in South Korea; attribution, full technical details, and broader targeting remain unclear at this time. For the original reporting, see The Hacker News.