New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Summary

Security researchers discovered a sophisticated Linux toolkit named 'ted' compiled into modified HAProxy binaries at two South Korean organizations. The malware intercepts web traffic, stealthily executes commands without logging, and selectively serves altered content to targeted visitors.

Key Takeaways

1. A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors.
2. The implant decrements HAProxy's live connection counters, thereby dropping the connection from the load balancer's statistics.
3. Upgrading does not clean a host the implant already sits on, because the attackers replace the binary rather than exploit a flaw in it.

Statement Breakdown

• Claimed Facts: 85% of statements the article presents as facts
• Opinions: 10% of statements classified as editorial or subjective
• Claims: 5% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies on detailed technical analysis from cybersecurity firm Rapid7 Labs, cross-referenced with data from Maltrail, ThreatFox, Kaspersky, and Mandiant. The reporting clearly distinguishes between verified technical behaviors and hypotheses regarding initial access and attribution. The author independently validated domain resolution status on Google Public DNS.

Bias assessment: Technical Cybersecurity Reporting. The text maintains an objective, technical focus on reverse-engineering, system architecture, and attribution methodology. It transparently highlights caveats in the investigation, such as missing initial-access evidence and overlapping threat actor infrastructure, without using sensationalist language.

Note: Findings rely on Rapid7 research and threat intelligence feeds regarding trojanized Linux binaries.

Credibility flag: Verified Threat Intel

Claimed Facts (6)

• This is a factual statement describing the core discovery of the Linux malware campaign.
• This details the technical mechanism by which the malware conceals its network activity.
• This outlines the explicit deployment prerequisites programmed into the malware stager.
• This reports an independent verification of DNS records performed by the publication.
• This is a factual statement concerning software versions observed on affected systems.
• This explains the remediation implications based on binary replacement rather than vulnerability patching.

Opinions (5)

• Threat attribution with medium confidence represents an analytical assessment rather than an indisputable fact.
• This is an expert evaluation expressing caution regarding the conclusiveness of available evidence.
• This is an operational recommendation and opinion on how defenders should prioritize inactive IOCs.
• This expresses an analytical projection regarding threat actor tracking challenges.
• This represents professional defensive recommendations offered by security researchers.

Claims (5)

• Highlights an unproven initial access theory based on correlative rather than direct evidence.
• Identifies malware functionality where connection to the primary threat actor remains unconfirmed.
• Points to overlapping multi-group attribution that blends three distinct threat clusters without definitive linkage.
• Asserts broad system binary tampering without publishing full standalone technical artifacts.
• Underlines an absence of definitive verification rules to confirm recompiled binary integrity.

Key Sources

• Rapid7 Labs — Cybersecurity research team
• The Hacker News — Cybersecurity news publication
• Mandiant — Threat intelligence and cybersecurity firm
• Kaspersky — Cybersecurity research vendor
• ENKI — South Korean cybersecurity research firm