[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJqyT9KR-Fy-aIveldtiRR6JNmWWH0SzOnDPZXIId6KI":3},{"article":4,"iocs":46,"watch_terms":61,"solutions":62,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"3b559203-021a-4274-af5c-f2ea78e21db8","New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic","new-ted-backdoor-hides-inside-victims-own-haproxy-builds-to-intercept-web-traffi-b1ea25","A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and","A new Linux backdoor, dubbed 'ted' by its creators, has been discovered embedded within trojanized HAProxy load balancers at two South Korean organizations. The malware intercepts and manipulates web traffic, serving altered pages to select visitors while evading detection by erasing its C2 requests from load balancer statistics. Rapid7 attributes the toolkit with medium confidence to North Korean state-sponsored actors.","New 'ted' backdoor found compiled into trojanized HAProxy builds in South Korea.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fnew-ted-backdoor-hides-inside-victims.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgzLyhHupZwRy1pOQzT93Qhs5waZ8gqtlgDJUKgt1f37dz3KqIDDZY8uNo8QguZNccBHivdA_ecnY8cQUyhZQAvLH4APu3imxP-rwo2dYLZtKnJ92IkRPFmwepmJgRk9GrLrJiN_IbInwvNXaW7N5761YfEB1IIK4uDdNBTy6Koz8uXgOSXaQWixXM1Wts\u002Fs1600\u002FHAProxy.jpg","2026-09-04T14:51:13+00:00","2026-09-04T16:00:15.642843+00:00",8,[17,20,23,26],{"name":18,"type":19},"HAProxy","product",{"name":21,"type":22},"North Korean state-sponsored actors","threat_actor",{"name":24,"type":25},"Rapid7","vendor",{"name":27,"type":22},"Kimsuky","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,53,55,57,59],{"type":48,"value":49,"context":50},"domain","img.monderhouse[.]space","C2 domain",{"type":48,"value":52,"context":50},"img.smartnords[.]site",{"type":48,"value":54,"context":50},"img.darklights[.]store",{"type":48,"value":56,"context":50},"img.responsive.pstatic[.]autos",{"type":48,"value":58,"context":50},"img.socialteams[.]store",{"type":48,"value":60,"context":50},"img.worksongo[.]store",[24,18],{"controls":63,"vendors":147},[64,92,121],{"slug":65,"name":66,"problem":67,"products":68},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":87,"url":90,"description":91},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":122,"name":123,"problem":124,"products":125},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"axoflow","Axoflow","\u002Fvendor-logos\u002Faxoflow.png","axolake","AxoLake","https:\u002F\u002Faxoflow.com\u002Faxolake-petabyte-security-data-storage","Data lake for security data in Parquet format, searchable in place without rehydration.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":143,"product_name":144,"url":145,"description":146},"falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",[148],{"slug":149,"name":24,"logo_path":150,"roles":151},"rapid7","\u002Fvendor-logos\u002Frapid7.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":171},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","Threat actors linked to North Korea compromised HAProxy load balancer binaries at two South Korean organizations, embedding a backdoor ('ted') directly into the victims' own builds rather than exploiting an upstream vendor — a classic supply chain \u002F build integrity attack. The malware intercepted and manipulated live web traffic while actively erasing evidence of its C2 communications from HAProxy statistics, demonstrating sophisticated anti-forensic tradecraft. This attack highlights the danger of trusting internally compiled binaries without cryptographic integrity verification, and the risk of load balancers sitting at the edge of networks without sufficient behavioral monitoring. When infrastructure software itself is weaponized, traditional signature-based detection fails, making build pipeline integrity and anomaly-based monitoring critical last lines of defense.",[158,159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-218: Secure Software Development Framework (SSDF)","NIST SI-7: Software, Firmware, and Information Integrity","NIST AU-12: Audit Record Generation","NIST SC-7: Boundary Protection (Network Segmentation)","MITRE ATT&CK T1195.002: Supply Chain Compromise – Compromise Software Supply Chain","MITRE ATT&CK T1565.002: Data Manipulation – Transmitted Data Manipulation","MITRE ATT&CK T1070: Indicator Removal on Host","ISO\u002FIEC 27001 Annex A 8.9: Configuration Management","ITIL: Change and Release Management",{}]