New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Summary: A previously undocumented Linux toolkit named ted was found compiled into trojanized HAProxy load balancers at two South Korean organizations, in the automotive and media sectors, where it intercepted web traffic and served altered pages to selected visitors. Rapid7 Labs attributed it with medium confidence to North Korean state-sponsored actors, and the implant erases its command-and-control requests from HAProxy's connection counters so neither backend logs nor load balancer statistics record them.
Why it matters: Both victims ran HAProxy 2.8.12, a release with 529 known bugs already fixed in the branch, and upgrading does not clean an infected host because the attackers replaced the binary rather than exploiting a flaw - a recompiled HAProxy reports the same version string as a clean build.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026