North Korea-linked hackers embed HAProxy backdoor for espionage

Cybersecurity firm Rapid7 reported a Linux toolkit linked to North Korean-aligned threat actors that embeds a custom “ted” backdoor into HAProxy and uses a curl-based remote access trojan and an SSH keylogger. Rapid7 says the tools were used to maintain long-term access, intercept web traffic, harvest credentials and issue remote commands from the load balancer.

Rapid7 identified the toolkit in use since at least late 2024, when the first affected HAProxy release appeared. Initial access began with exploitation of a vulnerability in a Groupware login portal on an edge server. The attackers installed a trojanized SSH keylogger that also functioned as a staging server for credential harvesting and lateral movement into internal systems.

The campaign included a custom backdoor compiled into HAProxy version 2.8.12, trojanized system binaries (agetty, atd, crond, polkitd and sshd), a stager component and CurlRAT, a curl-based remote access trojan. The stager checks for the presence of either crond or HAProxy before deploying CurlRAT; it can retrieve CurlRAT from an internal data section or from the compromised web server.

The “ted” backdoor is built as a plugin that hooks into HAProxy’s HTTP parser. Rapid7 reported it makes use of HAProxy’s native filter API, internal memory pools, event scheduler and process management to intercept and modify HTTP traffic while allowing normal load balancing to continue. The backdoor can establish command-and-control channels, exfiltrate data, inject scripts into web responses, and serve or redirect malicious content to selected clients.

CurlRAT is configured to poll its command-and-control server every 12 hours. It can decrypt and execute commands stored in its configuration, write new configuration payloads to disk and spawn an interactive PTY shell. The toolkit also supports session and cookie theft, targeted redirects, drive-by download attacks and selective hiding of tampered pages for specified IP ranges. Attackers blended payload delivery with normal browsing traffic and mimicked legitimate static content domains.

Artifacts recovered and the infrastructure used in the campaign match watering-hole techniques previously associated with APT37 and the Lazarus Group. The campaign timeline overlaps Operation SyncHole, an operation attributed to Lazarus last year; Rapid7 assessed that a North Korean-linked actor is likely responsible.

Rapid7 noted the backdoor’s integration at the load balancer gives the attackers a persistent foothold at the network edge and reported the framework was designed to support prolonged espionage against high-value targets in South Korea.

On the technical integration, Rapid7 wrote: “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.”