North Korean Hackers Hid a Backdoor Inside South Korea's Own Load Balancers
A previously unknown Linux implant has turned up baked directly into trojanised HAProxy binaries at two South Korean organisations, one in automotive, one in media. The malware intercepted live web traffic and quietly served modified pages to specific visitors. Researchers at Rapid7 found debug strings in the binary where the attackers had named their creation 'ted', which is either careless or brazen depending on your outlook.
This is not an HAProxy vulnerability. Getting ted in place requires the attacker to already have code execution on the host and the ability to swap out the running binary. That is a high bar, but apparently not high enough for whoever is behind this.
Rapid7 attributes the toolkit to North Korean state-sponsored actors with medium confidence, which is researcher-speak for 'we think it's them but we wouldn't bet the firm on it'.
The C2 mechanism is impressively clean. Sending a request to one specific image path flips the implant into command mode. It then decrements HAProxy's internal connection counters, wiping itself from the load balancer's own statistics. Commands arrive through a named pipe under /tmp, the request channel gets zeroed, and nothing gets forwarded to the backend. Responses go back over raw socket under a bog-standard HTTP/1.0 200 OK header. To any monitoring tool looking at traffic patterns, this looks like ordinary web activity.
Through that channel, operators can run shell commands, transfer files in both directions, and update the implant's configuration. Selective page tampering is also on the menu, but only for requests that clear four separate checks: a matching User-Agent, URL and referer patterns that both fit a stored rule, and either IP whitelisting (checked at both exact and /24 level) or an operator-controlled key tucked into the Accept-Language header. The implant also rewrites content-type and content-length headers on the way out, forces a 200 status code, and removes Accept-Ranges so the client cannot request byte ranges and notice the response size has changed.
Beyond the HAProxy implant itself, the toolkit is broader. A trojanised sshd captures plaintext passwords, encrypts them, and writes them to a fixed path. The same trojanised code turns up in agetty, atd, and polkitd binaries. There is also a companion RAT Rapid7 calls curlRAT, which phones home every 12 hours by default and shifts to 30-second intervals when the operator sets a flag. It checks for a marker file confirming the host is virtualised before doing anything, suggesting the operators are being selective about where they operate. For the avoidance of confusion, curlRAT is distinct from CurlBack RAT, a separate family attributed to Pakistan-linked SideCopy.
The stager only deploys where HAProxy or cron is already running, verifies root access first, then overwrites the legitimate crond binary and timestamps the replacement to match /usr/bin/ssh. It strips references to tmp, wget, cron, and crond from root's bash history and scrubs six system logs including auth.log and audit.log. Whoever built this knows what defenders look for.
Rapid7 admits it cannot establish how the attackers got initial access. The working hypothesis involves an exposed Groupware portal, a common Korean enterprise collaboration platform, drawing on prior ENKI research that documented Kimsuky compromising a groupware vendor through a mail server flaw. That is a hypothesis built on another campaign, not direct evidence from this one.
The attribution itself is a patchwork of three distinct North Korean clusters: APT37 for the domain infrastructure, Lazarus for the delivery model, and Kimsuky for the initial access theory. Mandiant noted in 2023 that North Korean groups share tooling and targeting to a degree that makes precise attribution genuinely difficult. Rapid7 acknowledged as much.
The C2 domains listed in Rapid7's indicators have all gone dark, returning NXDOMAIN on both A and NS lookups. They are useful for trawling historical logs, not for blocking anything live. All six domains appear in maltrail's APT37 infrastructure list at its new repository location following an August restructure, labelled there based on two posts made on X in July 2025, with no reference to Rapid7's research. Six additional domains sit in the same maltrail entries that Rapid7 did not include in its report.
Both victim organisations were running HAProxy 2.8.12, released in November 2024. The implant reads HAProxy's internal memory structures at hardcoded offsets specific to that build, so it would not function against other versions without modification. The current release on that branch is 2.8.28, some 16 point releases later, with HAProxy's own tracker listing 529 known bugs fixed since 2.8.12, including one critical and sixteen major issues. Upgrading, however, does nothing to clean a host that is already compromised. The attacker replaced the binary; there is no flaw to patch.
Rapid7 recommends network correlation, memory behavioural analysis, and binary integrity checks. It has not published detection rules for the latter, and a recompiled trojanised HAProxy reports the same version string as a clean build, so that last check is easier said than done.
This follows AhnLab and ENKI WhiteHat documenting a separate watering-hole campaign in July targeting the AnySign4PC signing client through compromised Korean websites. North Korean operators are clearly putting sustained effort into South Korean infrastructure, and they are getting quite good at hiding inside it.