Once active, ted intercepted incoming web traffic passing through the compromised load balancers. Instead of simply monitoring data, it selectively served altered web pages to chosen visitors, suggesting a highly targeted operation aimed at delivering modified content or credentials-harvesting pages to specific users. The use of trojanized HAProxy builds is notable because it allows malicious code to evade detection by masquerading as a trusted, frequently updated system component.

This discovery highlights a growing trend of threat actors abusing open-source software supply chains at the deployment stage. By embedding malicious code directly into a commonly used network tool, the attackers ensured their backdoor survived reboots and software updates, and remained invisible to traditional file-scanning solutions.

Key technical details:

• Implant name: ted, found in debug strings.
• Delivery method: Compiled into HAProxy binaries, not a HAProxy vulnerability.
• Prerequisite for installation: Prior code execution on the host.
• Observed behavior: Interception of web traffic and serving of altered pages to targeted visitors.
• Victims: Two organizations based in South Korea.

Source: The Hacker News

Given that this backdoor was compiled directly into HAProxy, how is your organization verifying the integrity of open-source binaries in production, especially those handling sensitive traffic?