DPRK-Linked Hackers Backdoor HAProxy Servers to Spy on South Korean Organizations

A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors.

The campaign is notable because it does not exploit a flaw in HAProxy itself.

Instead, the operators appear to have obtained code execution on targeted edge servers and replaced the legitimate HAProxy executable with a modified version of HAProxy 2.8.12.

The implant was compiled directly into the server binary and uses HAProxy’s native filter API, internal memory pools, event scheduler, and process-management functions to blend into a trusted network component.

The ted backdoor hooks HAProxy’s HTTP parsing process, allowing it to inspect decrypted HTTP traffic before requests are passed to backend services.

It can capture high-value request metadata, including source IP addresses, Host headers, Referrer values, User-Agent strings, cookies, and traffic matching attacker-defined regular expressions.

Rapid7 found that the implant can selectively trigger command-and-control communications through the endpoint /favorite_list_2x_m500_ico.jpg.

When this endpoint is requested, ted intercepts the payload, routes it through named pipes, and prevents it from reaching the backend application.

The attacker’s command traffic is therefore absent from application logs.

To reduce its visibility further, the malware alters HAProxy’s internal connection and request counters.

It decrements active and cumulative statistics associated with its C2 requests, masking anomalous activity in proxy telemetry and operational dashboards.

Responses are sent directly over raw sockets, making them appear as ordinary HTTP traffic despite bypassing HAProxy’s normal response flow.

Beyond remote command execution, ted can act as a selective web-injection platform.

The backdoor evaluates client IP addresses, User-Agent patterns, target URLs, Referrer values, and operator-controlled credentials before modifying a response.

This enables the attackers to serve malicious scripts only to selected visitors rather than broadly altering every page delivered through the compromised load balancer.

The capability is especially concerning for internet-facing groupware and web portals.

A compromised HAProxy server positioned in front of an enterprise application can silently steal session cookies, harvest authentication material, inject browser-side scripts, or conduct watering-hole activity against carefully selected users.

Because the malicious changes occur at the load-balancer layer, neither the originating application nor the backend server necessarily records the altered response.

Rapid7 said the toolkit’s traffic interception and payload-delivery features are consistent with long-term surveillance rather than disruptive operations.

The observed targets included organizations with exposed services on ports 80, 443, and 25, including groupware login portals and mail infrastructure.

However, researchers stressed that the initial-access mechanism and any exploited CVE remain unconfirmed.

Rapid7 Labs found that, the operation relies on a trojanized HAProxy build, dubbed ted backdoor, to covertly monitor, manipulate, and exfiltrate web traffic while continuing to serve legitimate load-balancing requests.

HAProxy Servers Backdoor

Ted is only one component of the larger framework. Rapid7 also identified altered versions of crond, agetty, atd, sshd, and polkitd, along with a stager, an SSH credential logger, and a curl-based remote-access trojan called CurlRAT.

The SSH implant intercepts legitimate plaintext passwords and stores them in an encrypted log file under /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19.

The operators used a recurring custom substitution cipher and Base64 encoding to protect harvested credentials and configuration data.

CurlRAT provides command execution, payload download, reverse-shell access, PTY shell access, host profiling, and system-information beacons.

It communicates with C2 infrastructure through HTTP or HTTPS using libcurl, polling at 12-hour intervals by default but capable of switching to a 30-second fast-poll mode.

The RAT also includes a watchdog function that tracks HAProxy process starts, stops, reloads, and restarts, then reports the service state to the operators.

The stager profiles the victim system, verifies root privileges, checks for HAProxy or cron activity, decrypts an embedded backdoored daemon, overwrites the legitimate binary, restarts the service, and timestomps the replacement to resemble /usr/bin/ssh.

It also selectively removes installation-related terms from shell history and Linux log files, including auth.log, secure, syslog, messages, and audit.log.

Rapid7 attributed the campaign to DPRK APT activity with medium confidence based on South Korean targeting, shared XOR and substitution-cipher techniques, and hardcoded infrastructure previously associated with APT37, also tracked as Ricochet Chollima.

The researchers noted that the infrastructure used low-cost domains such as .store, .space, .site, and .autos, frequently using img. subdomains to imitate image-serving or CDN traffic.

One observed domain, img.responsive.pstatic[.]autos, imitates Naver’s pstatic.net naming convention.

The earliest related VirusTotal uploads date to mid-2025, while the targeted HAProxy 2.8.12 build was released in November 2024, establishing the earliest possible compilation window.

The findings illustrate a growing risk to organizations that treat load balancers solely as infrastructure components rather than high-value security boundaries.

For defenders, unexpected HAProxy binary changes, unexplained counter inconsistencies, anomalous FIFO files in /tmp, modified cron binaries, and outbound traffic to image-themed domains should be treated as high-priority investigation leads.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.