← News
/DISPATCH · 2026-09-06

Rapid7 Discloses DPRK-Linked Supply-Chain Backdoor: Trojanized HAProxy Binaries Hijack South Korean Enterprise Web Traffic

Rapid7 Labs disclosed the Linux backdoor ted implanted in HAProxy and other system binaries at two South Korean automotive and media firms. It enables remote command execution, script injection against selected visitors, and credential theft. Attribution points to a DPRK-linked actor (medium confidence). Attackers replaced binaries after host compromise.

Rapid7 Labs disclosed a Linux backdoor toolkit codenamed ted backdoor. On servers at two South Korean enterprises, attackers replaced HAProxy and system binaries including crond, agetty, atd, sshd, and polkitd with backdoored, trojanized builds. Capabilities: remote command execution, targeted web-traffic tampering, credential theft. Rapid7 attributes the activity to a DPRK-linked actor at medium confidence, citing infrastructure overlap with APT37 and tradecraft similar to Lazarus Group. Target verticals: South Korean automotive and media.

Incident Overview

This is not exploitation of an HAProxy software vulnerability—attackers already had host code execution, then replaced the legitimate HAProxy binary with a trojanized compile. The backdoor filters traffic with precision: User-Agent, URL, Referer, and client IP. Only matching visitors receive tampered content. It also wipes C2 traces from HAProxy counters and manipulates HTTP headers to hide changes. Companion implant curlRAT provides the remote-control channel; trojanized sshd captures login passwords.

Technical Details

Stealth sits on three layers. First, legitimate programs carry malicious logic: trojanized binaries keep original function, so ops-side monitoring rarely sees a delta. Second, highly selective traffic tampering—only visitors matching preset conditions get injected scripts; security teams reproducing without those conditions still see a normal page. Third, anti-forensics: malicious-request stats are erased at the load-balancer layer. Reinstalling the application does not help; malicious logic lives in the system toolchain and the load balancer. Full triage needs binary integrity checks and disk-wide forensics.

Impact Assessment

The load balancer sits on the path of all user traffic—an ideal spot for watering-hole attacks, credential harvesting, and supply-chain poisoning. Injected content is same-origin with the target's site (same cert, same domain); phishing confidence is high. For firms with Korean-facing exposure or similar architecture, this incident flags binary supply-chain integrity as a neglected control: detection usually watches app and network layers, while swapped system tools silently kill log- and metric-based alerts.

Remediation

References