The 'Ted' Backdoor: Dissecting Trojanized HAProxy Builds and Infrastructure Weaponization

When the Gatekeeper Goes Rogue

Imagine a security guard at a corporate headquarters who doesn’t just check IDs, but selectively lets intruders into the vault while forging the visitor logs so nobody notices the breach. In enterprise architectures, the edge load balancer plays that exact role. It sits at the perimeter, parsing incoming traffic, terminating SSL connections, and routing requests to internal backend servers. Because it processes every single byte of incoming web traffic, it represents one of the most structurally powerful vantage points in modern IT infrastructure.

When threat actors set their sights on this layer, they aren’t just looking for a standard application-layer vulnerability like a SQL injection or a remote code execution bug. They are looking to own the foundational fabric of the network.

This shift in tactics is precisely what security researchers uncovered in a sophisticated Linux-based campaign dubbed the ‘Ted’ backdoor. Targeting South Korean organizations, this campaign bypassed traditional application vulnerabilities entirely, focusing instead on replacing legitimate enterprise binaries with trojanized builds. The primary target? HAProxy—one of the most widely deployed, high-performance open-source load balancers on the planet.

For DevOps engineers and Linux system administrators, the ‘Ted’ campaign serves as a sobering reminder of how modern threat actors operate. It highlights an evolution in supply chain and infrastructure attacks where the deployment environment itself is weaponized. Much like recent supply chain incidents such as the BdThemes JSON poisoning attack or automated workspace compromises seen in the KeyV npm worm incident, attackers are moving past simple malware scripts. Instead, they are integrating malicious logic directly into the software components we trust implicitly to run our production environments.

Anatomy of the Implant: Target Architecture and Version Locking

The ‘Ted’ backdoor is not a generic script dropped into a /tmp directory. It is a precise, surgical modification of a compiled Linux ELF binary. To understand how the malware operates, we must first look at its rigid operational requirements.

Unlike worms that scan the internet for unpatched services, ‘Ted’ requires prior host access. An attacker must already possess administrative privileges—typically via compromised credentials, prior lateral movement, or an exploited service—to swap out the legitimate binary on disk.

Once on the system, the malware is remarkably selective. It does not attempt to hook into arbitrary versions of HAProxy or compile itself dynamically against arbitrary source code trees. Instead, it specifically targets HAProxy version 2.8.12.

Why version locking? The answer lies in how the implant achieves its persistence and stealth. Rather than injecting logic at the source code level and recompiling the entire project, the threat actors utilized fixed memory offsets tailored explicitly to the symbol table and function layouts of HAProxy 2.8.12.

By hardcoding these memory offsets, the trojanized binary can patch runtime behavior dynamically as execution flows through the network stack. When the daemon boots up, the modified instruction pointers redirect control flow to malicious routines embedded within the binary structure. These routines monitor incoming HTTP traffic streams before they ever reach the standard stream processing logic, turning the trusted load balancer into a stealthy interception engine.

Ghost in the Machine: Traffic Interception and Log Scrubbing

What makes the ‘Ted’ backdoor particularly insidious is its mastery of stealth. A compromised load balancer that immediately crashes, floods system logs, or throws obvious error codes on monitoring dashboards will trigger incident response teams within minutes. ‘Ted’ avoids this by actively manipulating both data flows and operational telemetry.

When an HTTP request hits a standard HAProxy instance, the daemon updates internal connection counters, writes access logs to disk or syslog, and displays real-time statistics via administrative sockets or stats endpoints. The ‘Ted’ implant intercepts this pipeline using a multi-layered approach:

1. Traffic Diversion: The malicious binary inspects incoming HTTP/1.0 and HTTP/1.1 traffic. If a request matches specific, attacker-defined signatures or Command and Control (C2) parameters, the binary intercepts the stream entirely.
2. Channel Zeroing: To ensure backend infrastructure remains completely unaware of the intrusion, the implant zeroes out the request channels destined for the internal servers. The backend applications receive no logs, no payload, and no indication that a malicious interaction ever occurred.
3. Counter Manipulation: The malware actively alters HAProxy’s internal connection counters and state tables. When an administrator queries the load balancer’s statistics endpoint or reviews metrics, the numbers are artificially balanced to reflect normal operational baselines.

“By zeroing out request channels and manipulating internal connection counters, the malware ensures that backend servers and monitoring dashboards remain blind to malicious C2 traffic passing directly through the edge.”

This deep level of tampering means that traditional infrastructure monitoring tools—which rely on the application itself to report its health and traffic metrics—are effectively weaponized against the defenders. The monitoring system reports green, the logs show standard traffic patterns, and meanwhile, the edge proxy is quietly facilitating bidirectional C2 communications.

Persistence and Lateral Movement: Named Pipes and Trojanized SSHD

Traffic interception is only useful if the attacker can maintain long-term access and pivot deeper into the network. The ‘Ted’ toolkit achieves this by combining local IPC mechanisms with secondary system-level compromises.

Once command-and-control instructions are received through the trojanized HAProxy instance, execution must be handled on the host system. The malware relies heavily on /tmp named pipes (FIFOs) for inter-process communication and command execution. By establishing these named pipes, the implant can pass instructions to lightweight bash scripts and custom utilities running silently in the background without spawning noisy, easily detectable process trees that alert Endpoint Detection and Response (EDR) agents.

Furthermore, the threat actors do not rely solely on the load balancer for persistence. Investigations into environments compromised by ‘Ted’ have revealed companion components, including trojanized sshd binaries.

# Conceptual representation of how an implant might utilize 
# local named pipes for silent command execution and proxying
mkfifo /tmp/haproxy_pipe
tail -f /tmp/haproxy_pipe | /bin/bash 2>&1 > /tmp/haproxy_pipe &

By tampering with the Secure Shell daemon, the attackers enable credential harvesting capabilities—capturing plaintext passwords and SSH keys as administrators log into the infrastructure edge. This creates a multi-tiered foothold: if the HAProxy binary is somehow updated or restarted with a clean package manager update, the compromised sshd components and hidden named pipe routines ensure the attackers retain administrative access to the underlying Linux host.

This mirrors broader trends in state-sponsored infrastructure targeting, where physical or logical edge devices—much like the geopolitical cyber-espionage cases involving trojanized traffic infrastructure seen in incidents such as the Slovakian traffic camera backdoor—are systematically converted into permanent, fortified listening posts.

Attribution and Broader Geopolitical Context

From an attribution perspective, threat intelligence researchers trace the ‘Ted’ backdoor campaign to North Korean state-sponsored threat actors with medium confidence.

The assessment is based on a convergence of factors:

• Targeting Profile: The campaign focuses heavily on strategic South Korean organizations, aligning directly with the geopolitical priorities of Pyongyang-backed cyber espionage units.
• Operational TTPs: The preference for deep infrastructure weaponization, bespoke binary patching, and the concurrent deployment of credential-harvesting SSH daemons mirrors the operational tempo of known APT groups operating in the region.
• Tooling Characteristics: The specific engineering choices—such as rigid version locking against widely deployed open-source tools rather than relying on zero-days—reflect a methodology that values persistence and quiet espionage over chaotic disruption.

State-sponsored intrusions targeting edge infrastructure represent a distinct strategic intent. Rather than deploying ransomware for immediate financial extortion, campaigns like ‘Ted’ are designed for long-term intelligence gathering, traffic redirection, and silent reconnaissance. By controlling the edge load balancer, an adversary can quietly harvest enterprise credentials, intercept sensitive communications, and maintain a resilient bridgehead deep inside foreign corporate networks without ever triggering high-severity alerts.

Defense and Mitigation: Securing the Infrastructure Edge

Defending against an adversary who replaces legitimate binaries on disk requires moving beyond traditional perimeter security and signature-based antivirus solutions. If an attacker has root access to your Linux host, they can overwrite system binaries at will. Therefore, mitigation must focus on binary integrity, immutable infrastructure patterns, and runtime behavioral monitoring.

1. Implement Mandatory Access Controls and Binary Integrity (IMA/EVM)

The Linux Kernel’s Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) provide cryptographic verification of files read from disk.

• IMA measures files before they are executed or opened, comparing their hashes against a known-good baseline stored in extended attributes.
• If a threat actor attempts to swap out /usr/sbin/haproxy with a trojanized build like the ‘Ted’ variant, the kernel detects the hash mismatch and blocks execution entirely, even if the attacker has root privileges.

2. Move Toward Immutability

Traditional pets-versus-cattle server management leaves systems vulnerable to persistent binary modifications. Modern edge architectures should embrace immutable deployment models:

• Deploy HAProxy via containerized workloads (e.g., Docker or Kubernetes) running on minimal, read-only root filesystems.
• If a container image is modified or compromised, restarting the pod restores the pristine, cryptographically signed base image instantly.
• Treat edge load balancers as ephemeral workloads rather than long-lived virtual machines that accumulate drift over time.

3. Out-of-Band Telemetry and Network Monitoring

Because the ‘Ted’ backdoor successfully blinds internal monitoring by zeroing out logs and manipulating statistics endpoints, defenders cannot rely solely on the load balancer’s self-reported metrics.

• Implement out-of-band network monitoring (e.g., span ports, network taps, or independent intrusion detection systems) to analyze actual traffic patterns hitting the external interface versus what the application claims to process.
• Audit system binaries regularly using automated file integrity monitoring (FIM) tools that compare running binary memory hashes against upstream package manager databases (e.g., rpm -V or dpkg --verify).

Future Outlook: The Evolution of Infrastructure Weaponization

The ‘Ted’ backdoor campaign marks an important milestone in the evolution of infrastructure-level compromises. As enterprise security teams harden cloud environments, implement robust identity management, and deploy advanced EDR solutions on workstations and application servers, threat actors are inevitably shifting their focus downward.

We are moving away from an era where attacks primarily target application-layer flaws toward a landscape where foundational system daemons, core networking binaries, and deployment pipelines are routinely weaponized. When core daemons like HAProxy, SSH, and system utilities can be silently subverted via fixed memory offsets and binary replacement, traditional endpoint monitoring is no longer sufficient.

Ultimately, defending against this class of threat requires the industry to embrace hardware-rooted trust, secure boot environments, and strictly enforced binary integrity controls across every layer of the software stack. The gatekeeper can no longer be trusted simply because it wears the right uniform; its integrity must be cryptographically proven at every single boot.