New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic 新型Ted后门隐藏在受害者自己的HAProxy构建中，用于拦截网络流量

TL;DR

• A previously undocumented Linux toolkit has been compiled directly into trojanized HAProxy load balancers used by two South Korean organizations in the automotive and media sectors, enabling covert interception and manipulation of web traffic.
• The implant, named "ted" based on debug strings, operates by intercepting requests to a specific image path, writing command bodies to a named pipe under /tmp, and returning output over raw sockets disguised as standard HTTP/1.0 200 OK responses.
• The attack is not a HAProxy vulnerability but requires prior code execution on the host and the ability to replace the running binary; C2 requests are erased from HAProxy's connection counters, leaving no trace in backend logs or load balancer statistics.
• The same toolkit includes a trojanized sshd that captures and encrypts plaintext passwords, trojanized agetty/atd/polkitd binaries, and a companion RAT called curlRAT that beacons every 12 hours (dropping to 30 seconds when flagged) but only runs on non-virtualized hosts.
• Rapid7 attributes the campaign with medium confidence to North Korean state-sponsored actors, drawing on evidence linking APT37 domains, Lazarus-group delivery models, and Kimsuky-style initial access through an exposed Groupware portal.

Why It Matters

This attack demonstrates a sophisticated supply-chain-adjacent compromise where the implant is baked directly into a victim's own HAProxy binary rather than exploiting a vulnerability in the software itself, making detection through standard patching or vulnerability scanning ineffective. For AI practitioners and security researchers, it highlights the growing importance of binary integrity verification and the need for runtime behavior monitoring, especially for critical infrastructure components like load balancers that sit at the network perimeter.

Technical Details

• The implant uses a four-check gating mechanism before delivering modified pages: the request must carry a valid User-Agent, match URL and referer patterns, satisfy client address whitelist rules (checked both exactly and at the /24 subnet level), or contain an operator-supplied key in the Accept-Language header that overrides address filtering entirely.
• C2 communication is stealthily embedded in normal web traffic: command requests target a specific image path, the implant decrements HAProxy's live connection counters to erase evidence, writes commands to a named pipe at /tmp, and returns output on the raw socket with rewritten content-type, content-length, and status fields while stripping the Accept-Ranges header to prevent clients from detecting size discrepancies.
• The stager deploys only on hosts where HAProxy or cron is already running, verifies root access, overwrites the legitimate crond binary with a replacement bearing the creation timestamp of /usr/bin/ssh, and actively sanitizes root's bash history and six system logs (including auth.log and audit/audit.log) by stripping keywords like tmp, wget, cron, and crond.
• curlRAT, the companion remote access trojan, includes anti-VM detection by aborting execution unless a marker file indicating virtualization is absent, and features adaptive beaconing that defaults to 12-hour intervals but can be compressed to 30 seconds via operator flag.
• Indicators of compromise include six C2 domains (img.monderhouse.space, img.smartnords.site, img.darklights.store, img.responsive.pstatic.autos, img.socialteams.store, img.worksongo.store), specific file paths (/var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, /tmp/jasper-log, ~/cache/haproxy-1000.cache), and two SHA-256 hashes for the trojanized binaries.

Industry Insight

Organizations running HAProxy or similar critical infrastructure components should implement binary integrity monitoring and checksum verification against known-good builds, as this attack model bypasses traditional vulnerability-based detection by replacing the binary itself rather than exploiting a flaw in it. Security teams should also audit for anomalous named pipes under /tmp, unexpected modifications to system binaries like crond and sshd, and connections to image-serving endpoints that exhibit unusual response patterns, as these are strong indicators of this specific implant family. The attribution blending across APT37, Lazarus, and Kimsuky underscores the need for threat intelligence platforms to track cross-cluster tooling overlap, as North Korean operations increasingly share infrastructure and techniques across otherwise distinct groups, complicating both detection and response prioritization.

TL;DR

• 朝鲜国家支持黑客组织在HAProxy负载均衡器中植入名为"ted"的后门，拦截并篡改韩国汽车和媒体行业组织的Web流量
• 后门通过特定URL路径触发C2模式，命令经/tmp命名管道传递，响应伪装成普通HTTP/1.0 200 OK流量，同时擦除连接计数器和系统日志规避检测
• 攻击者替换了crond、sshd、agetty、atd、polkitd等多个系统二进制文件实现持久化，并部署curlRAT作为辅助后门
• Rapid7以中等置信度将攻击归因于朝鲜APT37、Lazarus和Kimsuky三个组织的协作，揭示了朝鲜网络部队跨集群共享工具和重叠目标的趋势

为什么值得看

本文揭示了针对基础设施层（HAProxy）的高级供应链攻击手法，对依赖负载均衡器的企业具有直接警示意义。同时展示了朝鲜黑客组织跨集群协作的新模式，为威胁情报分析和归因研究提供了重要案例。

技术解析

后门工作机制：攻击者通过请求特定图片路径触发C2模式，后门递减HAProxy活动连接计数器使连接从统计中消失，将命令体写入/tmp下的命名管道，随后清零请求通道使命令在负载均衡器层面终止。响应通过原始套接字以标准HTTP/1.0 200 OK头返回，伪装成正常Web流量。

反检测与持久化技术：后门覆盖合法的crond二进制文件并伪造其创建时间戳为/usr/bin/ssh的时间，同时从root的bash历史和六个系统日志（包括auth.log和audit/audit.log）中清除tmp、wget、cron、crond等关键词。配套的curlRAT默认每12小时信标一次，操作员可将其缩短至30秒，且仅在检测到虚拟化标记文件时才执行。

访问控制与流量过滤：只有满足四个条件的请求才会收到修改后的页面：携带特定User-Agent、URL和Referer模式匹配、客户端地址在白名单中（精确匹配或/24级别匹配）、或Accept-Language头中包含操作员密钥可覆盖地址过滤。

响应篡改技术：后门在输出时重写内容类型和长度，强制响应状态为200，并删除Accept-Ranges头防止客户端通过字节范围请求发现内容大小变化。

基础设施与归因证据：Rapid7发现六个C2域名（如img.monderhouse.space等），这些域名在maltrail项目中被列为APT37基础设施。归因综合了三个朝鲜黑客集群的特征：APT37提供域名基础设施、Lazarus提供交付模式、Kimsuky提供初始访问假设（通过韩国Groupware门户）。

行业启示

供应链安全需升级验证机制：攻击者能够替换已部署的HAProxy二进制文件，说明仅依赖官方包管理器不足以保障安全。企业应建立二进制完整性校验机制，对生产环境的可执行文件进行哈希监控和变更审计。

负载均衡器应纳入纵深防御体系：HAProxy等基础设施组件常被忽视为攻击面，但本文展示了其作为中间人拦截流量的巨大危害。安全架构应将负载均衡器纳入SIEM监控范围，关注异常连接计数变化和命名管道活动。

朝鲜网络部队呈现协作化趋势：Mandiant和Rapid7的分析表明，传统上独立运作的APT37、Lazarus和Kimsuky正在共享工具和重叠目标，这增加了精确归因的难度。威胁情报团队需调整归因模型，从单一组织视角转向集群协作视角进行分析。