New 'Ted' Backdoor Hides in HAProxy to Intercept Web Traffic
A Linux backdoor named 'Ted' has been found in trojanized HAProxy builds at South Korean organizations, intercepting and modifying web traffic while requiring prior code execution on the host.
Why it matters
This backdoor targets critical web infrastructure components, posing a significant challenge for network monitoring and incident response due to its stealthy interception and alteration of web traffic.
SOC impact
Monitor web traffic patterns and HAProxy deployments for signs of unauthorized modifications. Investigate any unusual behavior or network anomalies related to HAProxy instances. Validate the integrity of HAProxy binaries and review host execution logs to detect possible prior code execution enabling the implant.
Recommended actions
- Identify deployed HAProxy instances within the network
- Review HAProxy binary integrity and verify against trusted sources
- Monitor network traffic for alterations or interception anomalies
- Investigate host activity for unauthorized code execution events
- Correlate telemetry with threat intelligence on 'Ted' backdoor indicators
Executive Summary
Security researchers have discovered a new Linux backdoor, dubbed ‘Ted,’ embedded in trojanized builds of the HAProxy web proxy software in South Korean organizations. The backdoor is designed to intercept and manipulate web traffic, targeting key infrastructure components. The implant is not exploiting a vulnerability in HAProxy itself but requires prior execution of malicious code on the host system. This highlights the risk of supply chain or software tampering attacks affecting foundational network components, potentially enabling stealthy traffic interception. Detecting such threats demands focused monitoring of HAProxy deployments, validation of binary integrity, and scrutiny of host execution activity to identify signs of compromise.
SOC Impact
Monitor web traffic patterns and HAProxy deployments for signs of unauthorized modifications. Investigate any unusual behavior or network anomalies related to HAProxy instances. Validate the integrity of HAProxy binaries and review host execution logs to detect possible prior code execution enabling the implant.
What SOC Teams Should Validate
- Identify deployed HAProxy instances within the network
- Review HAProxy binary integrity and verify against trusted sources
- Monitor network traffic for alterations or interception anomalies
- Investigate host activity for unauthorized code execution events
- Correlate telemetry with threat intelligence on ‘Ted’ backdoor indicators
Why It Matters
This backdoor targets critical web infrastructure components, posing a significant challenge for network monitoring and incident response due to its stealthy interception and alteration of web traffic.