Espionage Toolkit Concealed in HAProxy
Attackers concealed surveillance tools inside a modified HAProxy build and several Linux system programs. The evidence suggests a North Korean actor, but it doesn't confirm the attribution.
- Report priority
- Medium
How it works
- The attackers exploited an unnamed flaw in a Groupware login portal to enter an edge server.
- They installed an SSH keylogger that collected credentials and helped them move to internal systems.
- An installer deployed CurlRAT, while the attackers also placed a custom backdoor compiled into the victim's HAProxy source on the load balancer.
- The tools could execute commands, steal data, and inject or redirect web traffic.
- The source doesn't identify the portal product or disclose the flaw's technical cause.
What to do
Ask the Linux or HAProxy maintainer to review build provenance and package-integrity results for systems matching those observed conditions. An unauthorized local HAProxy build or altered system program needs investigation. A matching version alone doesn't prove tampering or compromise. Normal files on one host don't clear other systems.
The campaign report doesn't publish a fix or validated cleanup procedure. Send unauthorized builds or file changes, affected host names, and integrity results to your incident response team and request a compromise assessment. Replacing modified software wouldn't by itself prove that the earlier compromise was removed.
Technical details
Attackers exploit a login flaw in a company's Groupware portal to reach an edge server facing the internet. They install a keylogger on SSH connections to steal passwords used to log into other internal machines. Using those stolen credentials, they compile a modified version of HAProxy 2.8.12 containing a hidden backdoor and swap it in for the real load balancer, so it keeps routing normal traffic while quietly injecting malicious content into some visitors' web sessions.
The custom HAProxy component is called “ted backdoor.” It uses HAProxy's filter API and built-in memory, scheduling, process and HTTP handling functions to intercept traffic while normal load balancing continues. CurlRAT contacts attacker-controlled servers every 12 hours and can execute commands, replace its configuration, or open an interactive terminal for the attacker. Rapid7 linked the artifacts to techniques associated with APT37 and Lazarus, but the attribution remains uncertain.