New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
-
A newly identified Linux backdoor, named ted in debug strings left by its developers, was found compiled directly into trojanized builds of HAProxy on systems belonging to two South Korean organizations. The implant did not exploit any vulnerability in HAProxy itself; the attackers had already achieved code execution on the target hosts and chose this stealthy persistence method to blend in with legitimate network infrastructure.
Once active, ted intercepted incoming web traffic passing through the compromised load balancers. Instead of simply monitoring data, it selectively served altered web pages to chosen visitors, suggesting a highly targeted operation aimed at delivering modified content or credentials-harvesting pages to specific users. The use of trojanized HAProxy builds is notable because it allows malicious code to evade detection by masquerading as a trusted, frequently updated system component.
This discovery highlights a growing trend of threat actors abusing open-source software supply chains at the deployment stage. By embedding malicious code directly into a commonly used network tool, the attackers ensured their backdoor survived reboots and software updates, and remained invisible to traditional file-scanning solutions.
Key technical details:
- Implant name: ted, found in debug strings.
- Delivery method: Compiled into HAProxy binaries, not a HAProxy vulnerability.
- Prerequisite for installation: Prior code execution on the host.
- Observed behavior: Interception of web traffic and serving of altered pages to targeted visitors.
- Victims: Two organizations based in South Korea.
Source: The Hacker News
Given that this backdoor was compiled directly into HAProxy, how is your organization verifying the integrity of open-source binaries in production, especially those handling sensitive traffic?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login