News Date: 2026-09-04
A newly documented Linux implant called Ted demonstrates how attackers can convert a trusted load balancer into a concealed command channel and traffic-manipulation platform. The toolkit was discovered inside modified HAProxy binaries at two organizations in South Korea, operating in the automotive and media sectors.
This is not a vulnerability in HAProxy itself. Installing the implant requires attackers to have already gained sufficient access to replace or rebuild the legitimate binary. That distinction matters because ordinary vulnerability scanning may find nothing wrong while the application continues to report an expected product version.
Commands Disappear at the Load Balancer
Ted recognizes specially constructed web requests and processes them directly inside HAProxy. The command traffic does not need to reach the backend application, helping the attacker avoid records in web application logs. Researchers also found mechanisms designed to remove relevant connections from HAProxy statistics, further reducing evidence available to administrators.
The implant can execute shell commands, transfer files and change its configuration. It may also alter pages for selected visitors while leaving normal traffic untouched. This filtering capability could support targeted malware delivery, credential theft or surveillance without visibly disrupting the wider service.
Related components reportedly included modified system programs and a trojanized SSH service capable of capturing passwords. The broader toolkit also attempted to erase selected evidence from shell histories and operating system logs. Researchers assessed a possible connection to North Korean state-sponsored activity with medium confidence, although the available evidence did not support definitive attribution.
How Defenders Should Respond
- Compare deployed HAProxy binaries against independently obtained, trusted builds.
- Check package signatures, file hashes, timestamps and unexpected compilation differences.
- Collect network telemetry outside the load balancer so one compromised system cannot erase every record.
- Inspect memory and running processes rather than relying exclusively on disk-based scanning.
- Review privileged access, build pipelines and administrative activity for the initial compromise.
- Rebuild affected hosts from trusted media and rotate credentials that passed through them.
A Warning About Infrastructure Trust
In my view, Ted is important because it attacks the assumption that network infrastructure is an impartial observer. Security teams often depend on proxies and load balancers to provide reliable logs, but a compromised enforcement point can manipulate both traffic and the evidence used to investigate it.
Organizations should therefore maintain independent layers of visibility, including upstream flow records, endpoint telemetry and centralized logs protected from alteration. Updating HAProxy may address unrelated software defects, but it will not remove a malicious binary from an already compromised server. Recovery must begin by restoring trust in the host, not simply upgrading the application installed on it.