Ted Backdoor (Trojanized HAProxy Implant)

Technical Analysis

The Ted implant is not delivered via a HAProxy vulnerability but is instead embedded at compile-time into custom HAProxy binaries, requiring the attacker to already have code execution and build-pipeline or host access on the target infrastructure. Once running, the backdoor operates within the load balancer process to intercept live web traffic and selectively serve modified pages to chosen visitors, suggesting capabilities for web-based malware staging, credential harvesting, or targeted content injection. The debug strings referencing 'ted' suggest an active development toolkit rather than a one-off implant, implying possible reuse across additional targets. Because HAProxy commonly sits in front of internal APIs, RAG pipeline endpoints, and agent orchestration services, a compromised load balancer of this type could allow attackers to intercept or alter API keys, tool-call responses, or retrieved documents passed to AI agents operating behind it, making this agent-relevant if such infrastructure uses similarly built or shared HAProxy binaries.

Affected Systems

Custom-built or self-compiled HAProxy load balancer deployments (specific versions not disclosed); Linux server infrastructure at two identified South Korean organizations

Indicators of Compromise

• Implant name/debug string: 'ted'
• Trojanized HAProxy binaries (build hashes not disclosed in source)
• Affected organizations: two unnamed South Korean entities

Remediation Steps

1. 1

   Verify HAProxy Build Integrity

   Compare deployed HAProxy binaries against official upstream release hashes or rebuild from verified source to detect unauthorized code insertion.

2. 2

   Audit Build Pipelines

   Review CI/CD and internal build processes for unauthorized access or tampering that could allow injection of malicious code into compiled binaries.

3. 3

   Inspect for Debug Strings

   Scan binaries and running processes for the 'ted' debug string or other anomalous symbols indicating implant presence.

4. 4

   Monitor Outbound Traffic and Content Serving

   Analyze load balancer logs and served content for signs of selective page alteration or unexpected traffic interception behavior.

5. 5

   Restrict Host Access

   Harden access controls on hosts running HAProxy, since deployment of Ted requires prior code execution on the host.

6. 6

   Rotate Credentials Behind Compromised Load Balancers

   Rotate API keys, session tokens, and secrets that may have transited compromised HAProxy instances, particularly those used by backend AI agent or API services.