What happened
The reporting identifies two unnamed South Korean victims, one in the automotive sector and one in media. The reported ted backdoor was compiled into HAProxy version 2.8.12 rather than installed as a separate adjacent process. The toolkit included ted, curlRAT, an SSH keylogger and trojanised agetty, atd, crond, polkitd and sshd binaries. The implant reportedly used HAProxy’s native filter, memory, scheduling and process mechanisms to intercept traffic while ordinary load-balancing functions continued.
Ted could inspect or alter HTTP traffic after TLS termination, execute commands, collect data and selectively inject content. Reporting says command-and-control requests did not reach backend servers and were removed from HAProxy’s own connection counters. SecurityWeek reports that curlRAT polled its command-and-control channel every 12 hours for tasks. The SecurityWeek report did not publish malicious hash values or a complete command-and-control domain list. Initial access was partially reconstructed around an exposed groupware portal, but no specific vulnerability was established.
The cited reporting says the toolkit may have been in use since late 2024, although the precise compromise timeline remains unpublished. Rapid7’s underlying research was first reported publicly on 3 September 2026. Additional specialist reporting on 7 September 2026 surfaced the load-balancer integrity implications to a broader enterprise audience. Attribution posture: Rapid7’s assessment, as reported by The Hacker News, links the toolkit to North Korean state-sponsored actors with medium confidence and says further evidence is required.
Why this matters now
A compromised TLS termination point occupies a uniquely trusted position. It can inspect decrypted requests, authentication cookies and responses while continuing to provide apparently normal load-balancing service. If the implant also suppresses its own activity from connection statistics, conventional health checks and backend logs may falsely indicate that the device is operating cleanly. Security leaders must therefore require build provenance and host-level integrity evidence for edge infrastructure.
The reporting does not describe a vulnerability in HAProxy itself. It describes an attacker replacing or recompiling trusted software after obtaining host-level access. Patching HAProxy without determining how the binary changed, how credentials were collected and which adjacent systems were reached would not close the incident. The decision spans edge-server forensics, groupware exposure, SSH credential containment, software provenance and potential watering-hole impact on users passing through the load balancer.
The decision for security leaders
Commission an integrity-led review of TLS termination systems. Validate package origin, build records, file hashes, loaded modules, startup configuration and daemon provenance rather than accepting successful health checks. Prioritise locally compiled, manually installed or weakly governed appliances because normal patch tools may not detect a maliciously rebuilt binary.
If integrity cannot be proven, preserve forensic evidence and replace the system from a trusted build pipeline. Scope credentials and sessions that traversed the host, including SSH access and authenticated web traffic. Treat any altered load balancer as an interception point with potential downstream user impact, not merely as a compromised Linux server.
Evidence of closure
- HAProxy binary hashes match approved build provenance across managed load balancers.
- Configuration review finds no ted plugin, altered daemon or unauthorised package.
- Credential-reset records cover accounts exposed to affected SSH or groupware systems.
- Host and packet review documents the absence or containment of curlRAT activity.
The Security.io assessment
The technically important change is the recognition that a trusted network component can conceal activity by editing the same operational counters defenders use for assurance. The original research preceded this edition’s primary window, but fresh reporting highlighted the enterprise consequence without establishing new victims or stronger attribution. Inclusion is justified by the distinct control decision: prove edge-software provenance independently of service telemetry.
This is not evidence that ordinary HAProxy installations are remotely exploitable or that updating alone resolves the risk. The documented condition required prior control sufficient to replace or recompile trusted software. Organisations without evidence of related exposure should perform targeted integrity validation, while organisations finding altered binaries should escalate directly to incident response, credential containment and potential user-impact analysis.
Questions for the morning meeting
- Can the organisation prove the provenance of every production load-balancer binary?
- Do integrity controls cover software compiled locally or delivered outside package repositories?
- Which credentials and sessions traverse TLS termination systems?
- Would monitoring detect a load balancer falsifying its own counters and logs?