# Built Into the Wall: How the "Ted" Backdoor Turned HAProxy Into a Wiretap
When you find malware on a compromised server, you go looking for the dropper, the process, the file that shouldn't be there. You check your EDR, pull YARA signatures, scan running processes. The "Ted" implant gives you nothing. It *is* the process. It's HAProxy — just not the one you compiled.
Researchers have uncovered a previously unknown Linux toolkit embedded directly inside trojanized HAProxy load balancer binaries at two South Korean organizations. The attackers didn't install a backdoor alongside HAProxy. They rewrote HAProxy, recompiled it, and let the victim's own infrastructure run it for them. The implant's name — "ted" — comes from debug strings the attackers left in the binary itself, a small piece of tradecraft sloppiness in an otherwise methodical operation.
## The Build Pipeline as Weapon
The framing that matters here is not "new malware found on Linux servers." The framing is: someone had enough access to modify source code and execute a build.
Installing "Ted" isn't a one-click exploit. The researchers are explicit that this is not a HAProxy vulnerability. Delivering it requires code execution on the host, then source modification, then a clean recompile. That means the attackers either compromised a developer machine with access to the build environment, infiltrated the CI/CD pipeline itself, or had durable interactive access to the target systems long enough to pull this off without detection.
This is build-time compromise — the same category as SolarWinds, as the XZ Utils backdoor that nearly slipped into Linux distributions in 2024, as the 3CX supply chain incident. The difference is this wasn't a centralized upstream supply chain attack affecting thousands of customers. It was a precision strike against specific organizations, executed quietly enough that the victims were apparently running trojanized infrastructure for an unknown period before discovery.
## What a Load Balancer Sees
HAProxy's position in any architecture is exactly why this matters. It sits at the edge, in front of everything — handling TLS termination, routing, health checks, and all inbound HTTP/HTTPS traffic. Compromise the load balancer and you don't need to lateral-move to the application servers. You already see every request, every session token, every credential submitted through any form.
"Ted" takes explicit advantage of this position. The toolkit intercepted web traffic and served altered pages to *selected visitors* — not to everyone. That qualifier is significant. It means the implant contains filtering logic: IP-based targeting, user-agent matching, cookie inspection, or some other attribute used to identify which requests get the modified response and which pass through clean. That selectivity is the signature of an intelligence operation, not opportunistic cybercrime. The attackers had specific targets in mind and were willing to let ordinary traffic pass unmodified to stay hidden.
The altered-page capability suggests credential harvesting, session hijacking, or content manipulation — possibly all three. A load balancer serving subtly modified login pages to targeted IP ranges is a remarkably clean way to collect credentials from executives, specific departments, or external partners without triggering the kind of anomalies that mass exploitation produces.
## Two South Korean Organizations and the Question of Attribution
South Korea is a persistent target for state-level actors, particularly North Korea's Lazarus Group and its sub-clusters, which routinely target South Korean financial institutions, defense contractors, and government-adjacent organizations. Kimsuky has historically focused on think tanks and policy researchers. Chinese APT groups have also shown sustained interest in South Korean infrastructure, particularly in the semiconductor and defense sectors.
The precision of this operation — selective traffic interception, clean compilation, specific organizational targeting — fits the profile of a nation-state operation rather than financially motivated threat actors. Ransomware groups don't trojanize load balancers to serve altered pages to selected visitors. They encrypt everything and send a ransom note.
Attribution is not confirmed, and reading attribution into two data points is how analysis goes wrong. But the tradecraft is worth noting.
## Defending Against What You Built Yourself
This is the problem that binary integrity is designed to solve, and that most organizations haven't actually solved. If your HAProxy binary was compiled internally and no one verified it against a known-good hash or reproducible build, "Ted" could run undetected for months. Your process list shows haproxy. Your logs show normal traffic. Your EDR sees no new files dropped. Everything looks clean because everything *is* the malware.
The practical defensive posture:
---
## HackWire Analysis
The "Ted" backdoor is a case study in what happens when attackers don't need a zero-day because they have something better: time and access. Compiling malware into a production binary is not a novel concept, but it's still rare enough that most organizations have no systematic defense against it. The XZ Utils incident in early 2024 was a near-miss that put the security industry on notice about supply chain risks in open-source build pipelines. "Ted" shows the same technique being applied in targeted intrusion operations against specific organizations.
What's underreported in the initial framing is the detection gap this creates. Every detection methodology that looks for *anomalous processes*, *unexpected files*, or *network connections to unknown destinations* fails here. The process is legitimate. The files are expected. The network connections are exactly what a load balancer should be making. The only detection surface is the binary content itself — and that requires either hash verification against a known-good baseline or behavioral analysis sophisticated enough to notice that your HAProxy instance is occasionally serving different content to different requestors.
The South Korean targeting also deserves more attention than it's getting. This isn't a geographically incidental finding. South Korea sits at the intersection of several active APT campaigns, and load balancer compromise at the organizational edge is a high-value, long-duration access technique. If two organizations have been identified, the question worth asking is how many others haven't been.
Organizations running self-compiled or internally modified versions of critical network infrastructure software should treat this as a concrete, active threat model — not a theoretical one.
— HackWire Editorial
---
## Related Coverage