"Further evidence is necessary to make a more definitive assessment," Rapid7 said.
How "ted" hides inside HAProxy builds used by two South Korean firms
Security researchers at Rapid7 discovered an undocumented Linux toolkit compiled directly into trojanized HAProxy load balancer binaries deployed at two South Korean organizations — one in the automotive sector and one in media. The implant carries the debug string ted. Rapid7 emphasized this is not a HAProxy vulnerability: installing the implant requires code execution on the host and the ability to replace the running binary. Both victims ran HAProxy 2.8.12; the implant reads HAProxy's internal structures at offsets fixed to that release.
The C2 channel: a special image path, erased connections, and raw-socket replies
Rapid7 detailed a covert command-and-control mechanism that never reaches backend servers and is removed from HAProxy's own connection counters. A request for a specific image path flips the filter into C2 mode; the implant decrements HAProxy's live connection counters and writes the command body to a named pipe under /tmp. Zeroing the request channel leaves nothing to forward, so the command terminates at the load balancer and backend logs and load-balancer statistics do not record it.
Output returns on the raw socket under a standard HTTP/1.0 200 OK header, designed to look like ordinary web traffic. Operators can beacon, upload and download files, run shell commands, and replace the implant's configuration through that channel. Only requests that pass four checks receive modified pages: the request must carry a User-Agent and match URL and referer patterns, and delivery then depends on whitelist membership (checked exactly and again at the /24 level) or an operator key supplied in the Accept-Language header that overrides address filtering. The implant rewrites content-type and content-length, forces a 200 status, and deletes the Accept-Ranges header so clients cannot request byte ranges and notice size changes.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePersistence: trojanized system binaries, credential capture, and curlRAT
The stager deploys only where HAProxy or cron is already running, and it verifies root before dropping payloads. Rapid7 found the toolkit overwrites the legitimate crond binary, giving the replacement the creation timestamp of /usr/bin/ssh, and strips the keywords tmp, wget, cron and crond from root's bash history and from six system logs including auth.log and audit/audit.log. A trojanized sshd in the same toolkit encrypts captured plaintext passwords and writes them to a fixed path.
The same code appeared in trojanized agetty, atd and polkitd binaries. A companion remote-access trojan Rapid7 calls curlRAT beacons every 12 hours by default and drops to a 30‑second interval when an operator sets a flag; it aborts unless it finds a marker file indicating the host is virtualized. Rapid7 noted curlRAT is distinct from a different family called CurlBack RAT.
Indicators of compromise Rapid7 published
- Domains: img.monderhouse[.]space; img.smartnords[.]site; img.darklights[.]store; img.responsive.pstatic[.]autos; img.socialteams[.]store; img.worksongo[.]store
- Files and paths: ~/cache/haproxy-1000.cache; /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19; /var/lib/snapd/g580; /tmp/jasper-log
- SHA‑256: 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558; 4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5
The Hacker News confirmed on September 4 that none of the six domains currently resolves (NXDOMAIN for A and NS records via Google Public DNS), making them more useful for historical log review than for blocking live traffic. Rapid7 drew part of its domain evidence from maltrail and ThreatFox entries: maltrail's current APT37 file contains the six domains, and ThreatFox records five sightings timestamped July 2, 2025.
Attribution: Rapid7 ties code to North Korean clusters, with caveats
Rapid7 attributed the toolkit with medium confidence to North Korean state-sponsored actors and drew on three separate North Korean clusters in its analysis: APT37 for the domain list, Lazarus for the delivery model, and Kimsuky for the initial-access hypothesis. Rapid7 said it lacked sufficient evidence to make a more definitive assessment and hypothesized initial access through an exposed Groupware portal based on ENKI research about Kimsuky.
Mandiant observed that shared tooling and overlapping targeting can complicate precise attribution: "We believe that this will make precise attribution more difficult," Mandiant said. Rapid7 compared the delivery model to the Operation SyncHole campaign; Kaspersky researchers assessed with medium confidence that redirects in SyncHole may have run malicious scripts against a flaw in the Cross EX browser helper. AhnLab and ENKI WhiteHat previously documented a related watering‑hole campaign in July that abused compromised Korean websites to attack the AnySign4PC signing client.
What this means for HAProxy operators, South Korean automotive and media organizations, and network defenders
- HAProxy operators and maintainers: Upgrading HAProxy does not remove an implant that replaces the binary; Rapid7 noted that the implant reads internal structures fixed to 2.8.12 and that recompiled HAProxy reports the same version string as a clean build, complicating simple integrity checks. Rapid7 recommended independent network correlation and memory behavioral analysis in addition to binary integrity checks.
- South Korean automotive and media organizations: The implant demonstrates selective interception and delivery of altered pages tied to web load balancers, and its ability to erase connections from HAProxy counters means backend logs may not reflect C2 activity — a critical point for incident responders at these sectors' sites.
- Network defenders and incident responders: The published IoCs, file paths and SHA‑256 values provide starting points, but The Hacker News confirmation that the domains now return NXDOMAIN underscores they are mainly useful for historical log searches. Responders should check for trojanized system services (crond, sshd, agetty, atd, polkitd), the presence of curlRAT and its beacon behavior, and hidden evidence such as stripped history and edited logs.
The discovery shows an implant designed to sit inside a trusted edge component and erase evidence from ordinary logs, while still presenting seemingly normal HTTP responses to observers. Rapid7's findings leave open how the attackers initially gained code execution on those hosts — a question the researchers linked to previous Groupware compromises but did not resolve. For defenders, the key takeaway is that host-level compromise of infrastructure binaries can defeat simple version-based checks; independent correlation and in-memory analysis are necessary to find what a replaced binary hides.
