Back Scworld

New Linux toolkit found in trojanized HAProxy targeting South Korean organizations

Scworld • September 4, 2026

As reported by The Hacker News, a sophisticated Linux toolkit, dubbed "ted" by its creators, has been discovered embedded within trojanized HAProxy load balancers at two South Korean organizations. This toolkit is designed to intercept web traffic and selectively serve modified content to specific visitors, indicating a targeted and stealthy approach by the attackers, according to Rapid7.

The implant, identified by Rapid7 Labs with medium confidence as originating from North Korean state- actors, targets entities in South Korea's automotive and media sectors. The attackers gained access by executing code on the host and replacing the legitimate HAProxy binary, rather than exploiting a vulnerability. This method allows the toolkit to operate undetected, as command-and-control (C2) requests are erased from HAProxy's connection counters, leaving no trace in backend logs or load balancer statistics. The implant filters requests based on specific criteria, including User-Agent, URL, referrer patterns, and client IP addresses, before serving altered pages. It manipulates HTTP headers to conceal modifications.

Evidence suggests the attackers may have gained initial access through an exposed Groupware portal, a common Korean enterprise collaboration software. The toolkit also includes a trojanized SSH daemon for capturing passwords and a companion remote access trojan (RAT) named curlRAT. Rapid7 recommends network correlation, memory behavioral analysis, and binary integrity checks for detection.

Source: The Hacker News

SC Staff September 2, 2026

Laura French September 2, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Ted Backdoor Targets South Korean Media and Automotive Sectors A new Linux toolkit, named the 'ted backdoor', has been discovered targeting South Korean organizations in the media and automotive sectors. This toolkit, attributed to North Korean state actors, integrates into HAProxy load balancers to intercept web traffic and deliver altered content. The toolkit allows attackers to execute remote commands, perform credential harvesting, and engage in long-term surveillance. Evidence suggests that the attacks may have been ongoing since early 2025, with the toolkit utilizing trojanized versions of various system binaries. The attack vector likely involves exploiting exposed Groupware portals, consistent with previously documented tactics used by the Kimsuky group. Rapid7 Labs has noted that the command-and-control requests are hidden from backend logs, complicating detection efforts. Further evidence is needed to establish a definitive timeline and initial access method. The toolkit's stealthy nature and integration with existing systems pose significant risks to affected organizations. 10 sources 68

Extracted Entities

New Linux toolkit found in trojanized HAProxy targeting South Korean organizations

The full story

Extracted Entities

Attack Types (2)

Countries (1)

Industries (2)

Malware (2)

MITRE ATT&CK (7)

Platforms (2)

Tools (1)