Cybersecurity firm **Rapid7 Labs** has revealed details of a stealthy Linux toolkit, named **ted** by its operators, found compiled directly into **HAProxy** load balancers. The discovery was made across two South Korean entities in the automotive and media sectors, where the implant was used to intercept and manipulate web traffic. ### Covert Operations and Evasion Tactics The **ted** implant is not a **HAProxy** vulnerability itself; rather, its deployment requires prior code execution on the host and the ability to replace the legitimate **HAProxy** binary. Once installed, it exhibits advanced evasion techniques. Command-and-control (C2) requests are designed never to reach backend servers and are meticulously erased from **HAProxy**'s own connection counters, ensuring they leave no trace in backend logs or load balancer statistics. According to **Rapid7**'s report, a specific image path triggers the implant's C2 mode. The toolkit then decrements **HAProxy**'s live connection counters, effectively dropping the connection from statistics. Command bodies are written to a named pipe under `/tmp`, and the request channel is subsequently zeroed, preventing any data from being forwarded. Output is returned on the raw socket with a standard `HTTP/1.0 200 OK` header, making the malicious exchange appear as ordinary web traffic. Through this covert channel, operators can beacon, upload and download files, execute shell commands, and modify the implant's configuration. ### Targeted Content Manipulation Modified pages are only served to visitors who meet a stringent set of four checks. Requests must include a **User-Agent** and match both URL and referrer patterns. Delivery then hinges on either the client's IP address being whitelisted (checked precisely and at the /24 level) or the presence of an operator key in the **Accept-Language** header, which overrides address filtering entirely. To further obscure its activities, the implant rewrites the content type and length of responses, forces the response status to 200, and deletes the **Accept-Ranges** header. This prevents clients from requesting byte ranges and detecting changes in content size. ### Initial Access and Attribution **Rapid7**'s investigation did not definitively establish a timeline or the initial compromise vector. However, a working hypothesis suggests attackers may have exploited an exposed Groupware portal, a common class of Korean enterprise collaboration software. This theory draws on **ENKI** research detailing how **Kimsuky** compromised a groupware vendor via a mail server flaw. Attribution efforts by **Rapid7 Labs** lean towards North Korean state-sponsored actors, with medium confidence. This assessment is supported by **Mandiant**'s 2023 analysis of North Korean cyber structures, which noted shared tooling and overlapping targeting across various clusters including **APT37**, **Lazarus**, and **Kimsuky**. ### Broader Toolkit and Evasion The **ted** stager only deploys on systems where **HAProxy** or **cron** is already running and verifies root privileges before dropping any files. It overwrites the legitimate `crond` binary, giving the replacement the creation timestamp of `/usr/bin/ssh`. Furthermore, it cleans up its tracks by stripping keywords like `tmp`, `wget`, `cron`, and `crond` from root's bash history and six system logs, including `auth.log` and `audit/audit.log`. The same toolkit includes a trojanized `sshd` binary that encrypts captured plaintext passwords and writes them to a fixed path. **Rapid7** also found this code in trojanized `agetty`, `atd`, and `polkitd` binaries. A companion remote access trojan (RAT), dubbed **curlRAT**, beacons every 12 hours by default, dropping to a 30-second interval when an operator flag is set. Notably, **curlRAT** aborts if it doesn't detect a marker file indicating a virtualized host, a common anti-analysis technique. It is distinct from **CurlBack RAT**, attributed to the Pakistan-linked **SideCopy** group. ### Indicators of Compromise (IoCs) **Rapid7** has shared the following IoCs: * **Domains**: * `img.monderhouse[.]space` * `img.smartnords[.]site` * `img.darklights[.]store` * `img.responsive.pstatic[.]autos` * `img.socialteams[.]store` * `img.worksongo[.]store` * **Files**: * `~/cache/haproxy-1000.cache` * `/var/lib/sshd/c8c68e629bba773a10ac80012d10bf19` * `/var/lib/snapd/g580` * `/tmp/jasper-log` * **SHA-256 Hashes**: * `72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558` * `4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5` While these domains currently return NXDOMAIN, they remain valuable for historical log analysis.  ### Recommendations Both victim organizations were running **HAProxy 2.8.12**. While **HAProxy** has released numerous updates since then, including critical and major bug fixes, upgrading the load balancer will not remove an existing **ted** implant, as the attackers replaced the binary rather than exploited a vulnerability within it. **Rapid7** advises organizations to perform independent network correlation, memory behavioral analysis, and binary integrity checks to detect and mitigate such advanced threats.