Ethical Hacking News
North Korea-linked Hackers Hide a Backdoor Inside HAProxy: A Masterclass in Stealthy Malware Infiltration
North Korea has once again demonstrated its prowess in the world of cyber warfare by hiding a backdoor inside the HAProxy load balancing software. This sophisticated malware, dubbed "ted backdoor" by security researchers, has been found in the source code of HAProxy, a widely used open-source load balancer, and has been linked to North Korean state-sponsored hackers. Learn more about this stealthy malware infiltration and what it means for organizations.
North Korea has hidden a backdoor in the HAProxy load balancing software, dubbed "ted backdoor" by security researchers. The ted backdoor is a custom plugin that intercepts HTTP traffic and is extremely difficult to detect. The malware sends commands through a simple trick and saves them in a named pipe, leaving no evidence of the attack in logs or connection logs. The ted backdoor also comes with a toolkit that modifies Linux system daemons, including SSH and curlRAT. The targeting pattern of the ted backdoor is linked to North Korean state involvement. The discovery highlights the importance of scrutinizing edge components with the same level of security as application servers. The ted backdoor serves as a reminder to organizations to prioritize security and take proactive measures to protect their systems.
North Korea has once again demonstrated its prowess in the world of cyber warfare by hiding a backdoor inside the HAProxy load balancing software. This sophisticated malware, dubbed "ted backdoor" by security researchers, has been found in the source code of HAProxy, a widely used open-source load balancer, and has been linked to North Korean state-sponsored hackers.
The ted backdoor is a custom plugin that is woven into the HAProxy source code, using its native filter API, internal memory management, and event scheduler to intercept HTTP traffic while keeping the load balancer running normally on top of it. This level of integration makes it extremely difficult to detect, and even security teams checking the logs may not be able to find any suspicious activity.
The malware receives commands through a simple trick, sending a request for a fake image at /favorite_list_2x_m500_ico.jpg, which switches the HAProxy filter into command-and-control mode. The command is then saved in a named pipe and removed from HAProxy's internal counters, leaving no evidence of the attack in the application logs or connection logs.
The ted backdoor also comes with a separate toolkit that modifies common Linux system daemons such as crond, agetty, atd, and sshd. These programs continue to work normally but also carry malicious features, including an SSH keylogger that captures passwords entered in plain text and a curlRAT tool that contacts a remote server every 12 hours, or every 30 seconds when the attacker enables its fast-poll mode.
The targeting pattern of the ted backdoor is believed to be linked to North Korean state involvement, with some technical overlap also drawing comparisons to a concurrent Lazarus Group campaign against South Korean media sites. However, further evidence is necessary to make a more definitive assessment.
The discovery of the ted backdoor highlights the importance of scrutinizing edge components, such as load balancers, with the same level of security as application servers. Relying on the component's own logs is not enough; securing these systems requires independent network correlation, memory behavioral analysis, and binary integrity checks.
In conclusion, the ted backdoor is a sophisticated example of stealthy malware infiltration, showcasing the capabilities of North Korean state-sponsored hackers. It serves as a reminder to organizations to prioritize security and take proactive measures to protect their systems from such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/North-Koreas-HAProxy-Hack-A-Masterclass-in-Stealthy-Malware-Infiltration-ehn.shtml
https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html
Published: Tue Sep 8 05:32:29 2026 by llama3.2 3B Q4_K_M
