Affected Systems

Two South Korean organizations in automotive and media sectors running compromised HAProxy load balancer binaries. The "ted" backdoor is compiled directly into trojanized HAProxy builds, not a vulnerability in legitimate HAProxy software. Requires prior root access and ability to replace running binaries. Additional trojanized system binaries include crond, sshd, agetty, atd, and polkitd.

Exploitation Status

Active supply chain compromise affecting two confirmed victims. Rapid7 Labs discovered the implant in production environments. Attribution with medium confidence to North Korean state-sponsored actors (APT37/Lazarus/Kimsuky infrastructure overlap). Initial access vector unconfirmed but hypothesized as compromised Korean Groupware portal. C2 domains (img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store, img.worksongo[.]store) confirmed non-resolving as of September 4, 2026.

Business Impact

Organizations running compromised HAProxy instances face covert traffic interception and manipulation invisible to backend logs and load balancer statistics. The implant allows attackers to serve altered web pages to targeted visitors, execute shell commands, exfiltrate files, and maintain persistent access through multiple trojanized system binaries (crond, sshd). SSH password capture affects all users authenticating to compromised hosts. Detection is difficult because C2 traffic mimics legitimate HTTP and is removed from HAProxy connection counters. The attack requires prior root compromise, indicating victims face broader infrastructure penetration beyond the HAProxy implant itself.

Urgency

🔴 Immediate

Recommended Actions

  • Verify integrity of HAProxy binaries against known-good hashes from official HAProxy repositories; check for unexpected compilation timestamps or debug symbols referencing 'ted'
  • Inspect system binaries crond, sshd, agetty, atd, and polkitd for modification dates inconsistent with package installation; compare hashes against distribution package manifests
  • Search filesystems for IoC artifacts: ~/cache/haproxy-1000.cache, /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19, /var/lib/snapd/g580, /tmp/jasper-log, and named pipes under /tmp
  • Review historical DNS logs and proxy records for connections to img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos, img.socialteams[.]store, img.worksongo[.]store, and six additional domains: primgs[.]lol, admin.primgs[.]lol, grip-cdns[.]space, show.grip-cdns[.]space, cleanos[.]online, app.cleanos[.]online
  • Audit Korean Groupware portal installations for unauthorized access or exploitation, particularly if exposed to internet; review authentication logs for anomalous admin activity
  • Examine root bash history and system logs (auth.log, audit/audit.log) for evidence of tampering or keyword removal (tmp, wget, cron, crond); check for gaps in log continuity
  • Reset credentials for all accounts on systems where trojanized sshd is detected, as plaintext passwords were captured and encrypted to /var/lib/sshd/ paths

---

# Geopolitical Context

Geopolitical Context

The discovery of the "ted" backdoor embedded in trojanized HAProxy load balancers at South Korean automotive and media organizations is consistent with long-standing North Korean cyber operations targeting the Republic of Korea's strategic sectors. Rapid7 Labs attributed the toolkit with medium confidence to North Korean state-sponsored actors, drawing on infrastructure overlaps with APT37, delivery models resembling Lazarus Group's Operation SyncHole, and initial-access patterns associated with Kimsuky. The targeting of automotive and media sectors aligns with Pyongyang's documented interest in both economic intelligence and information operations. The sophistication of the supply-chain compromise—requiring prior code execution and binary replacement—suggests a well-resourced adversary capable of maintaining persistent access to high-value networks. Mandiant's 2023 assessment noted that shared tooling and overlapping targeting across North Korean cyber clusters complicates precise attribution, reflecting the integrated nature of the DPRK's cyber apparatus under state direction.

State Actor Alignment

Rapid7 Labs attributed the intrusion set with medium confidence to North Korean state-sponsored actors, citing infrastructure links to APT37 (also known as Reaper or ScarCruft), operational parallels to Lazarus Group's watering-hole campaigns, and initial-access hypotheses consistent with Kimsuky tradecraft. The infrastructure domains identified in the campaign were catalogued in open-source threat intelligence repositories as APT37 assets as of July 2025. North Korea remains under comprehensive international sanctions, including UN Security Council resolutions targeting its cyber programs. The targeting of South Korean organizations continues a pattern of DPRK cyber activity against the ROK spanning espionage, intellectual property theft, and disruptive operations. The Democratic People's Republic of Korea has not publicly commented on these allegations, and attribution remains provisional pending additional corroborating evidence.

Business Impacty pro region

The compromise of South Korean automotive and media infrastructure underscores the persistent cyber threat the Republic of Korea faces from its northern neighbor. The automotive sector represents a strategic economic pillar for South Korea, a global leader in vehicle manufacturing and increasingly in electric vehicle technology—areas of potential intelligence interest to Pyongyang. Media sector targeting may support information-gathering on South Korean public sentiment, political developments, or preparation for influence operations. The use of trojanized enterprise collaboration software (Groupware) as a potential initial-access vector highlights vulnerabilities in widely deployed Korean business applications, which may have limited visibility to Western threat intelligence. For the broader Indo-Pacific region, the incident reinforces concerns about North Korean cyber capabilities and their application against U.S. treaty allies. It may prompt closer trilateral cyber cooperation among South Korea, Japan, and the United States, particularly following recent security coordination initiatives. European organizations with supply-chain or partnership ties to affected South Korean sectors should review their exposure to similar compromise vectors.

Forecast

If North Korean cyber operations continue to target South Korean critical infrastructure and strategic industries, Seoul is likely to accelerate investment in supply-chain security and load-balancer integrity monitoring, particularly for internet-facing enterprise systems. Should additional victims emerge in the automotive or defense industrial base, the U.S. Cyber Command and ROK military cyber units may expand information-sharing and joint threat-hunting activities under existing alliance frameworks. If the Groupware initial-access hypothesis is confirmed, South Korean vendors of enterprise collaboration platforms are likely to face regulatory pressure for security audits and mandatory vulnerability disclosure. Should the attribution to North Korean state actors solidify with additional technical evidence, the U.S. Treasury Department may designate associated infrastructure or individuals under existing DPRK sanctions authorities, though the operational impact of such measures on Pyongyang's cyber program has historically been limited. Organizations globally that deploy HAProxy or similar open-source load balancers in high-risk environments should consider implementing binary integrity verification and anomaly detection for command-and-control traffic masquerading as legitimate HTTP exchanges.