# New Ted Backdoor Embedded in Trojanized HAProxy Installations Intercepts Web Traffic
A previously undocumented Linux backdoor named ted has been discovered compiled directly into compromised HAProxy binaries affecting at least two South Korean organizations. Attackers embedded the implant during the build process, granting them persistent access to intercept and modify web traffic flowing through these load balancers.
The ted backdoor operates within HAProxy's process space, avoiding detection by running as a legitimate service component. Rather than exploiting a vulnerability in HAProxy itself, the attack requires attackers to gain initial code execution on the target host, then recompile HAProxy with the malicious code baked into the binary.
Security researchers identified ted through debug strings left embedded in the compromised binaries. The implant functions as a traffic interception tool, allowing attackers to selectively alter web pages served to specific victims. This capability enables targeted credential theft, malware distribution, or injection of malicious content directly into legitimate web applications without requiring users to visit malicious sites.
The attack chain demonstrates a sophisticated approach to persistence. By compromising the build process itself, adversaries ensure the backdoor survives service restarts and typical incident response measures that focus on detecting suspicious network behavior or file modifications. The implant runs with the same privileges as HAProxy, typically root or a dedicated service account, granting it broad access to inspect and manipulate all passing traffic.
HAProxy is a widely deployed open-source load balancing and proxy software trusted by organizations worldwide to distribute traffic across backend servers and optimize performance. Its presence across infrastructure stacks makes it an attractive target for supply chain attacks or post-compromise persistence mechanisms. The ted backdoor represents a narrowly targeted operation rather than mass exploitation, given the custom compilation required and the two confirmed victims.
Organizations running HAProxy face two distinct concerns. First, those managing their own builds must verify source code integrity and build pipeline security. Attackers inserting code during compilation leaves no trace in official repositories. Second, organizations relying on precompiled binaries should verify checksums against official sources and audit build environments for unauthorized modifications.
The attack impacts visibility and traffic analysis layers rather than underlying network infrastructure. Defenders cannot detect this backdoor through standard network monitoring alone because ted operates inside the legitimate HAProxy process. Detection requires either behavioral analysis of unusual traffic manipulation, forensic examination of the HAProxy binary itself, or careful review of build logs and source code integrity.
No patches address ted specifically because it is not a HAProxy vulnerability. Defense relies on host-level security controls: restricting code execution privileges, implementing build pipeline verification, monitoring file integrity of critical binaries, and maintaining strict access controls over production load balancers. Organizations should verify HAProxy binaries against official checksums and restrict who can modify or rebuild HAProxy instances in production environments.
The ted discovery highlights a broader trend of attackers targeting infrastructure software rather than end-user applications. Load balancers, proxies, and network devices occupy privileged positions in traffic flows, making them high-value targets for persistent access and traffic manipulation.