Stealth Load Balancer Infiltration: New 'Ted' Linux Backdoor Injected into HAProxy to Intercept Enterprise Web Traffic
Executive Summary
Threat researchers at Rapid7 Labs have uncovered a sophisticated, previously undocumented Linux malware toolkit dubbed "Ted", compiled directly into the production HAProxy reverse proxies and load balancers of major South Korean automotive and media organizations (The Hacker News). Attributed with medium confidence to North Korean state-sponsored threat actors, the implant allows adversaries to intercept live enterprise web traffic, inject malicious content into served web pages, and execute covert command-and-control (C2) routines—all while leaving zero traces in backend server logs or load balancer connection statistics.
Deep-Dive Technical Analysis
In-Memory Load Balancer Tampering & Invisible C2
HAProxy is widely deployed across enterprise architectures as a high-performance reverse proxy, SSL/TLS termination endpoint, and HTTP load balancer. Analysis of the "Ted" toolkit reveals a highly stealthy post-exploitation mechanism:
1. Host Compromise & Binary Replacement: The threat actors initially secured root code execution on host proxy servers through stolen administrative credentials. Rather than deploying traditional user-space malware or standalone backdoors, they compiled the custom "Ted" code directly into a trojanized HAProxy binary and replaced the running system executable.
2. Traffic Stream Interception: Operating within HAProxy's native stream processing engine, "Ted" hooks HTTP transaction buffers. It inspects incoming client requests and can dynamically alter HTTP responses served to targeted visitors, enabling watering-hole attacks and credential harvesting.
3. Ghost C2 Communication: The backdoor listens for incoming HTTP requests containing a specific image path trigger. When detected, the proxy enters C2 execution mode, interpreting the payload without forwarding the request to backend application servers.
4. Log & Counter Erasure: Crucially, "Ted" manipulates HAProxy's internal accounting data structures, decrementing connection counters and omitting C2 transactions from load balancer statistics and access logs. As a result, neither perimeter monitoring nor backend application logs record any evidence of adversary communication.
Infrastructure Threat Modeling & Reverse Proxy Blind Spots
The weaponization of core load balancing infrastructure represents an acute visibility crisis for enterprise security teams:
* Single Point of Traffic Visibility: Because reverse proxies terminate encrypted client TLS sessions before routing traffic to backend pools, compromising the proxy provides attackers with unencrypted visibility into all sensitive application traffic, including session cookies, API tokens, and user credentials.
* Bypassing Traditional EDR & SIEM Detection: By operating directly inside trusted networking daemons and suppressing accounting telemetry, stealthy implants like "Ted" avoid triggering standard process-anomaly alerts or traffic-spike thresholds.
Actionable Recommendations & Mitigations
1. Verify HAProxy Binary Integrity: Regularly verify the cryptographic hash of all running reverse proxy binaries against verified distribution package managers (e.g., via rpm -V or debsums) to detect unauthorized replacements.
2. Deploy Runtime File Integrity Monitoring (FIM): Enforce continuous FIM on all system binary directories (/usr/sbin, /usr/local/sbin) to immediately alert on modifications to system service binaries.
3. Enforce Read-Only Root Filesystems on Edge Proxies: Deploy reverse proxy servers on immutable, read-only root filesystems (e.g., containerized appliances or read-only OS mounts) to prevent on-disk binary modifications.
4. Audit System Administrative Logins: Enforce strict out-of-band management access, hardware-bound MFA (FIDO2), and centralized logging for all SSH and administrative access to network edge appliances.
________________
Sources & References: The Hacker News.