New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Threat actors linked to North Korea compromised HAProxy load balancer binaries at two South Korean organizations, embedding a backdoor ('ted') directly into the victims' own builds rather than exploiting an upstream vendor — a classic supply chain / build integrity attack. The malware intercepted and manipulated live web traffic while actively erasing evidence of its C2 communications from HAProxy statistics, demonstrating sophisticated anti-forensic tradecraft. This attack highlights the danger of trusting internally compiled binaries without cryptographic integrity verification, and the risk of load balancers sitting at the edge of networks without sufficient behavioral monitoring. When infrastructure software itself is weaponized, traditional signature-based detection fails, making build pipeline integrity and anomaly-based monitoring critical last lines of defense.