Rapid7 Labs published findings on Friday 4 September 2026 on a previously undocumented Linux toolkit found compiled into the HAProxy load balancers of two South Korean organisations, one in automotive and one in media.

The implant calls itself ted — the name comes from debug strings left in the binary — and ships alongside a second component Rapid7 tracks as curlRAT.

The coverage is calling it an HAProxy backdoor. It is worth being precise about what that does and does not mean, because the phrase points defenders at the wrong action.

It is not an HAProxy bug

Rapid7 is explicit: this is not a vulnerability in HAProxy. Installing the implant requires two things the attacker must already have — code execution on the host, and the ability to replace the running HAProxy binary.

So there is no CVE, no advisory, and no patch. If you read the headline and went to upgrade HAProxy, you did something worth doing for other reasons and nothing at all about this.

What it actually is: a decision about where to put a backdoor once you are already root. The attacker chose the process that sees every request, terminates every connection and writes the access log. That choice is the story.

The proxy is also the witness

The implant activates on a request to a specific image path. Once the channel is open the operator can beacon, upload and download files, run shell commands and replace the implant's own configuration.

The part worth sitting with: the C2 requests are erased from HAProxy's connection counters and from the backend logs. The proxy is the thing that counts your traffic and writes down what passed through it. Compromise it and you have not just added a listener — you have taken over the record of what happened.

Every detection strategy that starts with "look at the proxy logs" is now reading a document the attacker edits.

The version pin is the tell

Both victims ran HAProxy 2.8.12, released 8 November 2024. The implant reads HAProxy's internal structures at offsets fixed to that exact build, which is why it works at all — and which means it is welded to a binary the victims had not updated in roughly 21 months.

The 2.8 branch is now at 2.8.28, released 27 August 2026. Between 2.8.12 and current, HAProxy fixed 529 known bugs, including 1 critical and 16 major.

None of that is the attack. It is the condition the attack depended on. An implant compiled against fixed offsets survives exactly as long as the target does not rebuild, and these targets were not going to.

And the recompiled binary reports an identical version string to a clean build. Your inventory tool sees 2.8.12 and moves on.

Four filters decide who gets the altered page

The implant does not tamper with traffic indiscriminately. A visitor receives a modified page only when the request clears all of:

  • a User-Agent header is present
  • the URL and referer match the operator's pattern rule
  • the client address is whitelisted, by exact match or by /24
  • unless an operator key in the Accept-Language header overrides the address filter entirely

That last clause is what makes the whole thing usable in the field: the operator can reach the implant from any address by sending the right header. The address whitelist is for everyone else.

Rapid7 also found trojanised crond, sshd, agetty, atd and polkitd on the hosts, with the sshd variant capturing plaintext passwords. The HAProxy implant is the interesting one; it was not the only one.

curlRAT beacons every 12 hours by default, or at 30-second intervals when an operator flags the host, and aborts when it does not find a virtualisation marker. That is the inverse of the usual sandbox check, which aborts when it does find one — worth noting as reported rather than explained, because Rapid7 does not say why.

Attribution: medium confidence, three clusters

Rapid7 attributes the toolkit with medium confidence to North Korean state-sponsored actors. Read the components of that assessment:

  • a domain list resembling APT37
  • a delivery model compared to Lazarus
  • an initial-access hypothesis built on Kimsuky, citing ENKI research on a groupware vendor compromised through a mail server flaw

Three different clusters supplying three different parts of one judgment is not three times the confidence. Rapid7 says so itself, noting that overlapping tooling across North Korean clusters complicates precise attribution.

Medium confidence is the number they published. It is the number to repeat. We have written before about DPRK operations that are easier to describe than to attribute — the pattern holds here.

On how the attackers first got in, Rapid7's own words are that the evidence "was not enough to establish a timeline or determine how the attackers first got in". The groupware portal is a hypothesis, and is labelled one.

The IOCs are for hunting, not blocking

All six C2 domains Rapid7 lists were NXDOMAIN when checked on 4 September:

img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store, img.worksongo[.]store

Blocking dead domains protects nobody. Search backwards through your resolver logs instead. The file paths are more durable: ~/cache/haproxy-1000.cache, /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, /var/lib/snapd/g580 and /tmp/jasper-log.

Additional infrastructure appears in maltrail but not on Rapid7's list — primgs[.]lol, grip-cdns[.]space, cleanos[.]online and subdomains — and whether it belongs to the same operation is not established.

What to do

  • Compare your proxy binary against the package you think you installed. Hash it against the distribution's, or rebuild and diff. The version string will not help you; it is the same.
  • Stop treating the proxy's own logs as evidence about the proxy. Log to somewhere the proxy host cannot rewrite, and reconcile counts between the proxy and whatever sits in front of it.
  • Then update HAProxy anyway. 529 bugs, 1 critical, 16 major. Not because of this implant — because 21 months is 21 months, and this is the same neglect that makes every other advisory land harder than it should.
  • Check crond, sshd, agetty, atd and polkitd on the same hosts. The proxy was one of six.
  • Hunt the paths, not the domains.

What is not established

  • How the attackers got in. Rapid7 says the evidence does not support a conclusion.
  • When. No timeline was established.
  • Whether other HAProxy 2.8 builds are affected. The offsets are pinned to 2.8.12; whether the operators maintain builds for other versions is unknown.
  • Whether the additional maltrail infrastructure is the same operation.
  • Detection. No rules have been published, and the trojanised binary is version-identical to a clean one.