Do Son 
Attack chain partially reconstructed | Image: Rapid7
At a glance
| Actor or group | Suspected DPRK APTs (APT37 links, medium confidence) |
| Activity type | Linux backdoor, watering-hole injection, credential theft |
| Targets or victims | South Korean media and automotive organizations |
| Scale | Two confirmed victims; likely long-term espionage |
| Jurisdiction or status | No arrests or indictments reported |
| Source | Rapid7 Labs; Kaspersky; Mandiant |
TL;DR
Rapid7 Labs found a stealthy Linux toolkit named the ted backdoor. It hides inside the HAProxy load balancer to spy on South Korean firms. Researchers link it, with medium confidence, to North Korean state hackers.
What happened
Attackers rebuilt a real HAProxy binary to smuggle in malware. The ted backdoor compiles as a plugin inside HAProxy version 2.8.12. As a result, load balancing keeps working while the backdoor watches traffic.
Rapid7 spotted the campaign hitting South Korea’s media and automotive sectors. The activity likely dates back to early 2025. Alongside the backdoor, the crew shipped an SSH keylogger, a curl-based RAT, and a stager.
The toolkit trojanizes trusted system daemons. These include crond, agetty, atd, sshd, and polkitd. Consequently, the malware blends into normal Linux operations.
How the ted backdoor works
The plugin hooks HAProxy’s own HTTP parser. It then inspects and logs high-value requests, such as logins and admin panels. It can also steal session cookies from passing traffic.
Crucially, the backdoor picks its victims by IP address. When a target matches, it injects malicious scripts into the returned page. According to Rapid7, the compromised load balancer “silently redirects or serves malicious content to selected clients browsing through it, completing the watering-hole loop.”
The C2 traffic never reaches a backend server. Instead, the command request terminates at the load balancer itself. Therefore, no backend ever logs the attacker’s activity.
curlRAT and the stager
The stager checks for HAProxy or cron before acting. Only then does it drop the backdoored crond binary. It also timestomps files and scrubs system logs to erase traces.
curlRAT runs its main logic through crond using two threads. One handles C2 tasks over HTTPS with libcurl. The other watches HAProxy’s health and reports status to the operator. The RAT supports command execution, reverse shells, and interactive PTY sessions.
Who is behind it
Rapid7 attributes the toolkit to DPRK APTs with medium confidence. Several clues point toward North Korea. The targeting, the simple XOR and substitution ciphers, and the hardcoded C2 list all align with prior activity.
The hardcoded C2 servers tie to APT37 in ThreatFox and maltrail data. The watering-hole model echoes Operation Code on Toast, an APT37 campaign. It also overlaps with Operation SyncHole, a Lazarus operation documented by Kaspersky.
APT37 and Lazarus are separate North Korean clusters. Mandiant assesses that they work under different DPRK agencies. Still, both groups run espionage against South Korean targets.
Investigators stress caution here. As the report notes, “further evidence is necessary to make a more definitive assessment.” No suspect has been charged.
Impact and scale
Rapid7 confirmed two victims at the time of writing. Both ran an edge web server exposing ports 80, 443, and 25. Port 443 hosted a Groupware login portal, a common Korean enterprise target.
The likely goal is long-term spying, not quick theft. The keylogger grabs plaintext passwords. Meanwhile, the backdoor harvests cookies and can push drive-by downloads. Because the malware lives on the edge, it sees decrypted HTTP traffic.
How readers can stay protected
Treat edge devices as seriously as core servers. Rapid7 warns that trusting a component’s own logs is not enough. Defenders need independent network correlation and binary integrity checks.
Verify the integrity of HAProxy, sshd, and other system daemons. Additionally, watch for unexpected outbound HTTPS to unfamiliar “img.” domains. Patch internet-facing mail and Groupware portals quickly. Finally, monitor for tampered timestamps and missing log entries.
The bottom line
The ted backdoor shows how attackers weaponize trusted infrastructure. A load balancer became a spy and an injection point. Guard your edge, because that is where this threat lives.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
