Attackers replaced HAProxy with a traffic-spying backdoor
Rapid7 reported that attackers replaced legitimate HAProxy software at South Korean organizations with a malicious copy. The backdoor could inspect traffic and alter responses for selected users.
- Report priority
- Medium
- Targets
- Trojanized HAProxy executable tracked as ted
How it works
- Researchers say the operators first obtained code execution on targeted edge servers, but the initial access method and any exploited vulnerability remain unconfirmed.
- The reported stager checks for root privileges before overwriting the legitimate HAProxy executable, restarting the service and disguising the replacement's timestamps.
- The modified program can inspect decrypted requests, capture request details and intercept commands sent to a specific web address.
- It can also alter responses for selected visitors while hiding command traffic from backend logs and HAProxy counters.
What to do
Ask the HAProxy or server maintainer to identify the running executable and verify it against the trusted package or build used by your organization. Compare its SHA-256 hash with the three hashes listed for the ted backdoor in the published report. A malicious hash match confirms the observed backdoor sample, while a different hash doesn't rule out another modification. The maintainer should also investigate unexpected changes to crond, agetty, atd, sshd or polkitd, the file /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, unexplained named pipes used for communication between programs in /tmp, and HAProxy connection or request counts that don't match observed traffic.
If a malicious hash matches or integrity verification fails, have the incident response team investigate the host using the hashes and other indicators in the published report. Replacing the HAProxy executable alone wouldn't confirm that the wider compromise was removed.
Technical details
Affected software: Trojanized HAProxy executable tracked as ted
Rapid7 investigators found this rigged HAProxy already running on servers in front of South Korean automotive and media organizations' groupware login pages and mail systems, reachable on ports 80, 443, and 25. The compromised software quietly copied details from the real traffic passing through, including IP addresses, cookies, and browser information. When someone requested one specific disguised web address, the backdoor treated that as a hidden signal and carried out attacker commands instead of returning a real file, while also being able to insert malicious scripts into pages shown only to chosen visitors.
Rapid7 calls the HAProxy backdoor ted and attributes the campaign to North Korea-aligned attackers with medium confidence. Requests to /favorite_list_2x_m500_ico.jpg can trigger command handling. The backdoor passes commands between programs through named pipes and sends responses directly over network sockets, bypassing normal backend logging.
Reported companion components include CurlRAT, altered system daemons and an SSH credential logger. The source lists three SHA-256 hashes for ted and three for the CurlRAT installation component.