ted Backdoor: DPRK Weaves an Implant Into Victims' Own HAProxy Builds

• 1Nov 8, 2024 — HAProxy 2.8.12 is released. The implant is built to read this exact release's internal structures, with memory offsets hard-coded to 2.8.12.
• 2Jul 2, 2025 — Several of the campaign's C2 domain indicators first surface in open threat-intel sources (maltrail / ThreatFox), suggesting infrastructure staging well before disclosure.
• 3Aug 27, 2026 — HAProxy 2.8.28 ships upstream, underscoring how far behind the pinned 2.8.12 build sits on the victims' proxies.
• 4Sep 4, 2026 — Rapid7 Labs publishes its analysis of ted and curlRAT, tying the toolkit to two South Korean victims and DPRK-aligned activity. As of that date, all six C2 domains resolve to NXDOMAIN.

Rapid7 describes a stager that is deliberately conservative about where it fires. It deploys only where HAProxy or cron is already present and verifies root before dropping anything. That targeting discipline both reduces noisy failures and keeps the toolkit off honeypots and mismatched hosts.

• AExisting code execution on the Linux host (initial access vector not disclosed).
• BRoot privileges — the stager aborts if it cannot confirm them.
• CA running HAProxy or cron service to graft persistence onto.
• DAbility to swap the live binary for the recompiled, backdoored build.

A request for a specific image path flips the proxy into C2 mode. To ordinary monitoring this looks like a request for a static asset — exactly the kind of traffic a web front-end sees constantly — which is why the trigger hides in plain sight. Nothing about the request reaches the real backend.

This is classic traffic signalling: the implant listens for a covert pattern inside otherwise-legitimate HTTP rather than opening a new listener or beaconing outbound. No extra port, no obvious anomaly in the netstat table.

Before the implant will act on a triggering request, it enforces four independent checks. Together they ensure only the operator — from expected infrastructure, using the right client fingerprint — can drive the backdoor, and that a curious scanner stumbling onto the image path gets nothing.

When a request clears all four gates, the implant writes the command body to a named pipe under /tmp and returns the resulting output back to the operator on a raw socket, wrapped in a standard HTTP/1.0 200 OK header so the exchange reads as an ordinary successful web response.

• 1Beacon / check-in.
• 2Upload and download files.
• 3Run arbitrary shell commands.
• 4Replace the implant's own configuration on the fly.

The implant does two evasive things at response time. First, for C2 exchanges it rewrites the content type and content length, forces the response status to 200, and deletes the Accept-Ranges header to stop clients from making byte-range requests that would break the smuggled payload. Second — and this is the standout trick — it decrements HAProxy's live connection counters, removing the operator's requests from the proxy's own statistics.

Because the counters are adjusted and the request never touches the backend, the covert session leaves no trace in either the load balancer's stats page or the backend application logs. Alongside C2, the same inline position lets the operator selectively alter the pages that chosen visitors receive — the adversary-in-the-middle capability that gives the campaign its strategic value against a media target.

The implant overwrites the legitimate crond binary and then clones the creation timestamp of /usr/bin/ssh onto it. That timestomping makes the replaced binary look as old as an original system component, defeating the simple "what changed recently?" triage that responders reach for first.

The backdoored sshd intercepts authentication and encrypts captured plaintext passwords to a fixed file path, giving the operator a rolling harvest of valid credentials for lateral movement and re-entry — a hallmark of long-dwell server implants.

Rapid7's reporting associates the artefact path /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 with this component. Its presence on a host is a strong compromise signal in its own right.

Rapid7 tracks a second implant it calls curlRAT alongside ted. It beacons every 12 hours by default, dropping to a 30-second interval when the operator sets a flag — patient by default, responsive on demand. Critically, curlRAT aborts unless the host shows a virtualization marker file, an inversion of the usual anti-VM check.

The implant removes lines containing the keywords tmp, wget, cron and crond from the root bash history and from six system logs — including auth.log and audit/audit.log. Those keywords map directly to the toolkit's own staging and persistence activity, so the scrub is surgical rather than a blunt log wipe that would itself be suspicious.

Verify, don't trust versions

Hash internet-facing haproxy, sshd, crond, agetty, atd and polkitd against distro packages (rpm -Va, dpkg --verify) or a known-good gold image. Version strings lie here.

Forward logs off-host

Ship auth.log and auditd to a central SIEM in real time. The implant scrubs local copies but cannot reach forwarded records after the fact.

Egress + DNS control

Alert on the six img.* C2 domains and constrain outbound from edge appliances. A load balancer beaconing outbound is abnormal.

Trust upstream flow, not the proxy

The implant falsifies HAProxy's counters. Use netflow / span-port records upstream of the proxy as your source of truth for its traffic.

Rebuild, don't clean

A host with root-level trojanized system binaries should be re-provisioned from trusted media, not surgically cleaned. Rotate all credentials that touched it.

Hunt the initial access

ted deployment requires prior root. Its presence proves an earlier intrusion — trace how the operator first landed and close that door.