Ted Backdoor Compiled into HAProxy Binaries at Two South Korean Firms
Ted backdoor was found compiled into HAProxy at two South Korean targets, providing covert C2 while erasing its own traces from logs and counters. Rapid7 links it with medium confidence to North Korean operators but lacks direct evidence of initial compromise. The toolkit also deploys credential-stealing sshd variants and curlRAT.
Independent verification of the initial access vector remains absent. The hypothesis of an exposed Groupware portal draws solely from earlier ENKI reporting on mail-server flaws rather than direct telemetry from these victims. No timeline or infection vector was recovered. Subsequent activity is expected to target additional HAProxy deployments in Korean critical sectors if the operator maintains access to the same staging infrastructure.
Rapid7: Within 90 days, additional HAProxy binaries matching the 72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558 hash will appear in public malware repositories from at least one new Korean victim.
Sources (2)
- [1]Rapid7 Ted Backdoor Report(https://www.rapid7.com/blog/post/ted-backdoor-haproxy/)
- [2]ENKI Groupware Compromise Analysis(https://www.enki.security/kimsuky-groupware)