Linux HAProxy Trojan

Security researchers found a previously undocumented Linux toolkit compiled directly into trojanized HAProxy load balancers. Two South Korean organizations were affected. The attackers intercepted web traffic and served altered pages to selected visitors.

The attackers named the implant "ted." It's not a HAProxy vulnerability. Installing it requires code execution on the host and the ability to replace the running binary.

Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors. The two victims were in South Korea's automotive and media sectors.

Let me break down what's happening.

Quick Summary

The Implant: How It Works

C2 Mode Activation:

A request for one specific image path puts the filter into C2 mode. The implant decrements HAProxy's live connection counters. This drops the connection from the load balancer's statistics. It writes the command body to a named pipe under /tmp. Zeroing the request channel leaves nothing to forward. The command terminates at the load balancer.

Command Output:

Output returns on the raw socket under a standard HTTP/1.0 200 OK header. This makes the exchange look like ordinary web traffic.

What the Operator Can Do:

• Beacon
• Upload and download files
• Run shell commands
• Replace the implant's configuration

The Filtering:

Only requests clearing four checks receive a modified page. The request has to carry a User-Agent and match a rule whose URL and referer patterns both fit.

Whitelist or Override:

Delivery falls to either:

• Whitelist membership on the client address (checked at the /24 level)
• An operator key in the Accept-Language header that overrides the address filtering entirely

Content Modification:

The implant rewrites the content type and length on the way out. It forces the response status to 200. It deletes the Accept-Ranges header so a client cannot request byte ranges and notice the size change.

The Stager and Cleanup

The stager deploys only where HAProxy or cron is already running. It verifies root before dropping anything.

What It Does:

• Overwrites the legitimate crond binary
• Gives the replacement the creation timestamp of /usr/bin/ssh
• Strips keywords (tmp, wget, cron, crond) from root's bash history
• Cleans six system logs (auth.log, audit/audit.log, and others)

Trojanized Components:

Rapid7 found the same code in trojanized:

• sshd (captures plaintext passwords and writes them to a fixed path)
• agetty
• atd
• polkitd binaries

curlRAT: The Companion Backdoor

A companion remote access trojan called curlRAT beacons every 12 hours by default. It drops to a 30-second interval when the operator sets a flag. It aborts unless it finds a marker file showing the host is virtualized.

Note:

curlRAT is distinct from CurlBack RAT, a separate family attributed to the Pakistan-linked SideCopy group.

Indicators of Compromise

Domains:

• img.monderhouse[.]space
• img.smartnords[.]site
• img.darklights[.]store
• img.responsive.pstatic[.]autos
• img.socialteams[.]store
• img.worksongo[.]store

Files:

• ~/cache/haproxy-1000.cache
• /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19
• /var/lib/snapd/g580
• /tmp/jasper-log

SHA-256 Hashes:

• 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558
• 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5

Note:

The Hacker News confirmed on September 4 that none of the six domains resolves. They are useful for reviewing historical logs rather than for blocking live traffic.

Attribution

The Domain Connection:

Part of the attribution rests on a listing of those domains under APT37 in maltrail, an open-source detection project. All six are present in the new location, each labelled as APT37 infrastructure.

The Three Clusters:

The attribution passage draws on three separate North Korean clusters:

• APT37 for the domain list
• Lazarus for the delivery model
• Kimsuky for the initial-access hypothesis

What Mandiant Said:

"We believe that this will make precise attribution more difficult."

The SyncHole Connection

• Rapid7 compared the delivery model to Operation SyncHole. In that campaign, visitors to South Korean online media sites were filtered by a server-side script and redirected.
• Kaspersky researchers assessed "with medium confidence" that the redirected page may have run a malicious script against a flaw in Cross EX, a South Korean browser helper.
• Kaspersky's SyncHole report identified at least six victims in the software, IT, financial, semiconductor manufacturing, and telecommunications sectors.

HAProxy Versions

The Vulnerable Version:

Both victims ran HAProxy 2.8.12, released on November 8, 2024. The implant reads HAProxy's internal structures at offsets fixed to that release.

Current Release:

The current release for that branch is 2.8.28 dated August 27, 2026. That's 16 point releases later.

The Bug Count:

HAProxy's tracker lists 529 known bugs affecting 2.8.12 that are already fixed in the branch. This includes 1 critical and 16 major bugs.

Important:

Upgrading does not clean a host the implant already sits on. The attackers replace the binary rather than exploit a flaw in it.

What Organizations Should Do

1. Independent Network Correlation

Detect any network activity which is considered suspicious. Detect any communication channel which behaves similar to the C2 behavior pattern activation.

2. Memory Behavioral Analysis

Detect any abnormal process activity. Analyze the HAProxy process for unusual behavior.

3. Integrity Check of HAProxy Binaries

Perform an integrity check of the HAProxy binaries to determine whether they have been compromised. It can be a little tricky since the recompiled HAProxy binary has the same version string.

4. Finding the Trojanized Binaries

Watch out for these trojanized binaries:

• HAProxy
• sshd
• agetty
• atd
• polkitd

5. C2 Communications Detection

Watch out for beacons and other suspicious connections from these domains given in IoCs.

The Bottom Line

A Linux HAProxy trojan implant was found in South Korean load balancers. North Korean actors intercepted web traffic and served altered pages. The implant is sophisticated and hard to detect.

What You Need to Know:

What You Need to Do:

• Verify HAProxy version
• Validate binary authenticity
• Detect C2 traffic
• Trojanized binaries

FAQ Section

What is the Linux HAProxy trojan implant?

"ted" backdoor incorporated within trojaned HAProxy load balancers. This backdoor intercepts web traffic and delivers modified websites to chosen users.

Who is behind it?

Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors.

Which organizations were affected?

Two South Korean organizations in the automotive and media sectors.

How is the implant working?

It gets triggered by the specified image path request. The user is able to perform beacons, file uploads/downloads, execute shell commands, and change the configuration.

What are the recommendations for companies?

Verify HAProxy version, check binary integrity, detect C2 communication, and hunt for trojaned binaries.

Source: The Hacker News