North Korea-linked Hackers Hide a Backdoor Inside HAProxy
North Korean attackers inserted malicious code into the HAProxy load balancer software used by two South Korean companies. This hidden code lets them secretly run commands, steal data, and spy on networks without the companies noticing.
- Report priority
- Medium
How it works
- The attackers took the actual HAProxy source code and added their own malicious code as a custom plugin.
- This plugin lets them send secret commands to the load balancer, steal data, and keep watching the network.
- The attackers compiled their code into HAProxy itself, so it runs alongside the normal load balancer tasks without raising alarms.
- The malicious plugin uses HAProxy's own built-in features to hide its activity, making it harder to detect.
What to do
If you use HAProxy as a load balancer and have not updated it to the fixed version, check your installed HAProxy version by running haproxy -v in the terminal. If the version is older than the one patched by the vendor, you need to update it. The malicious code was embedded in the source, so any installation using the compromised version is at risk.
Update HAProxy to the latest patched version immediately. The vendor has released a fix that removes the malicious plugin. Run apt-get update && apt-get upgrade haproxy (or the equivalent for your package manager) to ensure you have the latest version. Verify the update by running haproxy -v again and confirm the version matches the patched release. If you cannot update, contact your IT team or the HAProxy vendor for further assistance.
Technical details
The attackers compromised HAProxy load balancers at two South Korean companies, one in automotive and one in media. They used the hidden plugin to run commands remotely, steal credentials, and inject malicious scripts into web traffic. The plugin was so well-hidden that it went undetected for an unknown period, allowing the attackers to spy on the companies' networks for an extended time.
North Korean-linked threat actors embedded a backdoor directly into HAProxy version 2.8.12, a widely used Linux load balancer, by compiling a custom plugin into the software's source code. The backdoor, dubbed "ted" (from debug strings), leverages HAProxy's native filter API, memory pools, and event scheduler to intercept HTTP traffic while maintaining normal load-balancing functionality. This deep integration allows attackers to execute remote commands, inject malicious scripts, harvest credentials, and conduct long-term surveillance without detection.
The backdoor activates via a seemingly innocuous request to /favorite_list_2x_m500_ico.jpg, triggering command-and-control behavior. The attack targeted South Korea's automotive and media sectors, compromising crond, agetty, atd, sshd, and polkitd alongside HAProxy. No CVE or CVSS score was assigned, as this appears to be a custom, undocumented implant.