Full Report
A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
Analysis Summary
# Tool/Technique: Ted Backdoor / Linux Trojanized Toolkit
## Overview
The "Ted" toolkit is a sophisticated, undocumented Linux-based implant designed to be compiled directly into legitimate HAProxy load balancer binaries. Its primary purpose is to intercept web traffic, provide stealthy remote access, and serve altered web content to specific targets. By operating at the load balancer level, it effectively bypasses traditional backend logging and monitoring systems.
## Technical Details
- **Type:** Malware family / Rootkit / Trojan
- **Platform:** Linux (specifically targeting systems running HAProxy, crond, and sshd)
- **Capabilities:** Traffic interception, web page rewriting, stealthy C2 communication, credential harvesting, and log tampering.
- **First Seen:** Publicly reported September 2026 (Rapid7).
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1543.002 - Create or Modify System Process: Systemd Service
- T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking (via trojanized binaries)
- **TA0005 - Evasion**
- T1070.002 - Indicator Removal: Clear Linux System Logs
- T1070.003 - Indicator Removal: Clear Command History
- T1564.001 - Hide Artifacts: Hidden Files and Directories
- **TA0006 - Credential Access**
- T1556.003 - Modify Authentication Process: Pluggable Authentication Modules (via trojanized sshd/agetty)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/1.0 200 OK masking)
- T1573 - Encrypted Channel
## Functionality
### Core Capabilities
- **HAProxy Integration:** Intercepts traffic at the load balancer level. It uses specific image path requests to trigger a C2 mode, which decrements live connection counters to hide the traffic from HAProxy statistics.
- **Traffic Manipulation:** Rewrites Content-Type and Content-Length headers and forces "200 OK" status codes to serve altered pages to visitors meeting specific criteria (User-Agent, URL/Referer patterns, and IP whitelisting).
- **Stealthy Execution:** Commands are written to a named pipe (`/tmp/jasper-log`) and results are returned via raw sockets, leaving no trace in backend application logs.
### Advanced Features
- **Anti-Forensics:** Automatically strips keywords (e.g., `tmp`, `wget`, `cron`) from `bash_history` and system logs like `auth.log` and `audit.log`. It also mimics file timestamps (e.g., matching the `ssh` binary).
- **Trojanized System Binaries:** The toolkit includes modified versions of `sshd`, `agetty`, `atd`, and `polkitd` to capture and encrypt plaintext passwords.
- **curlRAT:** A companion RAT that beacons every 12 hours (or 30 seconds if active) and includes a check for virtualization markers before proceeding.
## Indicators of Compromise
- **File Hashes (SHA-256):**
- `72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558`
- `4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5`
- **File Names/Paths:**
- `~/cache/haproxy-1000.cache`
- `/var/lib/sshd/c8c68e629bba773a10ac80012d10bf19`
- `/var/lib/snapd/g580`
- `/tmp/jasper-log` (Named pipe)
- **Network Indicators (Defanged):**
- `img.monderhouse[.]space`
- `img.smartnords[.]site`
- `img.darklights[.]store`
- `img.responsive.pstatic[.]autos`
- `img.socialteams[.]store`
- `img.worksongo[.]store`
- **Behavioral Indicators:**
- HAProxy binary size discrepancies.
- Unexpected presence of HTTP/1.0 200 OK headers in environments using HTTP/1.1 or HTTP/2.
- Missing entries in `auth.log` or `bash_history` related to common administrative tools.
## Associated Threat Actors
- **North Korean State-Sponsored Actors:** Attributed with medium confidence (linked to activities similar to Kimsuky/Lazarus Group).
## Detection Methods
- **Signature-based:** Scan for the "ted" debug strings and specific hardcoded file paths/hashes.
- **Integrity Monitoring:** Use tools like `AIDE` or `Tripwire` to detect unauthorized modifications to `sshd`, `haproxy`, and `crond` binaries.
- **YARA Rules:** Target the unique logic of the C2 trigger (specific image path request) and the decrementing of HAProxy connection counters.
## Mitigation Strategies
- **Binary Verification:** Regularly verify the checksums of critical system and service binaries against known good versions from official repositories.
- **Principle of Least Privilege:** Restrict root access, as the toolkit requires root privileges to overwrite system binaries.
- **Log Offloading:** Implement centralized logging (SIEM) where logs are forwarded in real-time to an external server, making local log tampering less effective.
- **Network Segmentation:** Limit the load balancer's ability to communicate with arbitrary external domains.
## Related Tools/Techniques
- **CurlBack RAT:** (Distinct from curlRAT, used by SideCopy).
- **GOMIR:** North Korean malware family associated with groupware compromises.
- **Adversary-in-the-Middle (AiTM):** General technique used to intercept and alter traffic.