New Trojanized HAProxy Load Balancers Expose North Korean Espionage Campaign Targeting South Korean Organizations
A fresh examination of a sophisticated espionage campaign has revealed that attackers compromised two South Korean organizations in the automotive and media sectors by deploying a previously undocumented Linux toolkit directly compiled into the hypertext transfer protocol (HTTP) load balancers used by those networks. Dubbed “ted” in the malware’s debug strings, the toolkit was designed to intercept incoming web traffic silently, selecting specific visitors to serve altered pages while thoroughly hiding its activities from the host server’s log files. The deployment was attributed with medium confidence to North Korean state-sponsored actors, showcasing an advanced understanding of enterprise infrastructure and targeted software abuse.
The implant operates by staying completely invisible to standard monitoring tools. Once a specific image path triggers its Command-and-Control (C2) mode, the toolkit decrements HAProxy’s live connection counters to erase its tracks, ensuring neither the backend logs nor the load balancer’s official statistics record the malicious traffic. The attackers route these exchanges through a named pipe located under the /tmp directory and immediately zero out the request channel, leaving no trace of the originating traffic behind the endpoint. Furthermore, they rewrite the content type and length headers, force a 200 OK response status code, and strip out any header that would allow a client to request byte ranges, effectively masking the size discrepancy between the legitimate and compromised content from being detected by the end user.
Operational parameters of the toolkit rely on strict filtering mechanisms. A request must contain a User-Agent and match specific URL and referer patterns. To proceed, it must also pass an address-based whitelist check conducted both at the exact IP level and the /24 subnet level, or it must contain a specific operator key embedded in the Accept-Language header that overrides the address filtering entirely. Once inside, the threat actor can beacon, upload and download files, execute arbitrary shell commands, and even replace the configuration of the implant itself. The campaign also involves overwriting other system services beyond HAProxy, including a trojanized SSH daemon that encrypts captured plaintext passwords, alongside compromised binaries for crond, agetty, atd, and polkitd. Additionally, the attackers deployed a remote access trojan known as “curlRAT” that beacons every 12 hours under normal conditions but accelerates to a 30-second interval when prompted by an operator, while first verifying that it is not running inside a virtualized environment.
Attribution centers on North Korean groups with overlapping identities such as APT37, Lazarus, and Kimsuky, whose shared tooling makes exact classification difficult. This reflects a broader trend of using complex, cross-linked operations rather than isolated exploits. Infrastructure includes a list of stale domains, all of which no longer resolve, and the entire campaign serves as a reminder that state-sponsored threats will directly manipulate trusted binaries and services to maintain access without relying on，软件漏洞。
**Frequently Asked Questions (FAQ)**
* **Q: What does HAProxy stand for and what is its primary function?**
A: HAProxy stands for High Availability Proxy. It is an open-source, high-performance load balancer and reverse proxy designed to distribute incoming network traffic across multiple servers, ensuring reliability and high availability of services by acting as a critical intermediary in data centers and web infrastructure.
* **Q: Is the “ted” toolkit a vulnerability or exploit in HAProxy itself?**
A: No, the toolkit is not an exploit of a vulnerability in the HAProxy software. It is a malicious payload compiled and run directly on the host system that replaces the legitimate binary. The attackers execute code on the host first, then swap the running binary, meaning the source of the compromise is unauthorized access and code execution, not a backdoor into the load balancer’s core functionality.一家企业
* **Q: How are the attackers able to deliver altered pages without exposing the campaign in server logs?**
A: The toolkit decrements HAProxy’s connection counters and erases C2 requests from the load balancer’s own statistics, ensuring that neither the server logs nor the monitoring tools record suspicious activity once a specific image path arrives. They delete the Accept-Ranges header to prevent clients from requesting byte ranges, thereby masking the size difference between legitimate and altered content and avoiding detection.
* **Q: Does upgrading HAProxy clean a host that has already been implanted?**
A: No, upgrading to the latest version of the software does not remove the implant. Because the attackers replaced the legitimate binary entirely with a malicious one, simply updating HAProxy may not overwrite the trojanized binary if the compromise persists and the new version is not installed cleanly.
* **Q: What are the available Indicators of Compromise (IoCs)?**
A: IOCs include non-resolving domains like media.software.software or img.darklights[.]store, and file paths such as ~/cache/haproxy-1000.cache and /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19. A full list of hashes and specific technical markers for detection is published in the primary security advisory. The IOP is to check the binary integrity of the load balancer files
**Conclusion**
The discovery of the trojanized HAProxy load balancers highlights the increasing sophistication of state-sponsored cyber operations targeting South Korean infrastructure. By compiling malicious code directly into trusted binaries and leveraging the “ted” toolkit, the attackers achieved persistent access and control over critical systems while evading standard logging mechanisms. From overwriting system services like the SSH daemon and cron jobs to deploying a beaconing remote access trojan, the campaign underscores the need for stringent binary integrity monitoring and behavioral analysis. With overlapping toolsets between North Korean cyber units making attribution challenging, organizations are urged to remain vigilant and adopt comprehensive detection strategies to identify and neutralize these stealthy threats before they yield significant impact.
Thank you for reading
