A Backdoor Hiding Inside Legitimate Load-Balancing Software

Researchers at Rapid7 have detailed a Linux-focused intrusion toolkit, attributed with medium confidence to North Korea-aligned actors, that has been quietly operating inside South Korean automotive and media organizations since as early as 2025. Rather than dropping obvious standalone malware, the operators built their primary implant, which Rapid7 calls the Ted backdoor, directly into a modified version of HAProxy 2.8.12 — widely used, legitimate load-balancing software that sits at the edge of corporate networks.

Because Ted lives inside software organizations already trust and rely on for normal traffic routing, it can inspect decrypted web requests passing through the server while the load balancer continues to function exactly as expected, giving administrators little reason to suspect anything is wrong.

Getting In Through Exposed Edge Servers

The compromised organizations shared a common weakness: edge servers with ports 80, 443, and 25 exposed to the internet, hosting groupware login portals and mail services respectively. These internet-facing systems, standard fixtures at most companies, gave the attackers their entry point into deeper network infrastructure. Rapid7 has not confirmed the exact initial access method, but the pattern points to systematic targeting of externally reachable web and mail infrastructure.

What the Ted Backdoor Can Do

Once embedded, Ted gives its operators a wide range of capabilities:

• Capturing session cookies and selected details from passing web requests
• Executing arbitrary remote commands
• Uploading and downloading files
• Injecting malicious scripts into legitimate web responses
• Communicating with its controllers through disguised, image-path-style requests
• Manipulating HAProxy’s connection counters to hide its own traffic from monitoring

The broader toolkit also includes an SSH keylogger and trojanized replacements for core system binaries — cron, agetty, atd, sshd, and polkitd — extending the attackers’ reach well beyond the load balancer itself.

Careful Installation, Careful Cover-Up

Before installing itself, the stager checks the target’s operating system and confirms both HAProxy and cron are present. It then replaces the cron service, copies file timestamps from legitimate SSH binaries to blend in, strips specific words from system logs, and protects its own configuration with XOR encryption and character substitution. Rapid7’s analysis also turned up hardcoded master passwords embedded directly in the malware’s authentication routines.

CurlRAT Adds Remote Control

A companion tool, CurlRAT, supplies the interactive command-and-control layer: polling attacker infrastructure for instructions, exfiltrating system information, installing further payloads, and spawning reverse or interactive shells with elevated privileges. It also runs a watchdog function that monitors HAProxy’s own service status, likely to keep the backdoor persistent even if the tampered process is restarted.

Infrastructure Disguised as Image Hosting

The operators routed their command-and-control through domains styled to look like harmless image-delivery or static-content services, with at least one domain deliberately echoing the naming conventions of a popular Korean web platform to blend into ordinary network traffic.

A Pattern Consistent With Long-Term Espionage

Rapid7 described the combination of credential theft, session-cookie harvesting, selective content tampering, and traffic redirection as consistent with long-term espionage rather than opportunistic cybercrime. The targeting of South Korean automotive and media firms also echoes previous North Korea-linked intelligence-gathering campaigns in the region, including past Kimsuky operations.

Recommendations for Defenders

• Verify edge-server binaries, especially HAProxy, cron, and SSH-related tools, against known-good versions and checksums.
• Inspect systems for unexpected shared libraries, modified cron jobs, and unusual scheduled tasks.
• Watch for suspicious image-path requests and abnormal outbound connections from load balancers.
• Compare web responses served to different visitors, since selective content tampering is a hallmark of this toolkit.
• Rotate credentials that may have passed through affected servers, and treat on-device logs as potentially unreliable — deploy independent, out-of-band monitoring where possible.
• Patch and harden internet-facing groupware and mail servers to reduce the attack surface these campaigns rely on.