Reported by 4 outlets

Timeline

1. original reporting

   DPRK-Linked Hackers Backdoor HAProxy Servers to Spy on South Korean Organizations

   gbhackers.com · 36d ago · September 7th, 2026

   A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in HAProxy itself. Instead, the operators appear to have obtained code execution on targeted edge servers […] The post DPRK-Linked Hackers Backdoor HAProxy Servers to Spy on South Korean Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   North Korea-Linked Hackers Turn Web Servers Into Stealthy Espionage Backdoors

   cyberpress.org · 36d ago · September 7th, 2026

   The campaign targeted organizations in South Korea’s automotive and media sectors, using compromised edge servers to steal credentials, monitor victims, inject malicious content into web traffic, and maintain long-term access. At the center of the operation is a modified HAProxy load balancer, named the “ted backdoor.” Rather than deploying a separate and easily detectable web shell, the attackers compiled the implant directly into HAProxy version 2.8.12. This lets the malware use HAProxy’s native filtering system, memory pools, event scheduler, and process controls while the server continues handling legitimate traffic normally. Rapid7 assesses the activity may be linked to North Korean threat actors with medium confidence. The targeting of South Korean organizations, use of simple XOR encryption and substitution ciphers, and command-and-control domains previously associated with APT37 support the assessment. However, the initial access method and a definitive attribution remain unconfirmed. North Korean Webserver Backdoors The ted backdoor can intercept decrypted HTTP traffic inside HAProxy before it reaches the backend server. It can inspect selected requests, capture session cookies and HTTP headers, and identify high-value targets based on IP addresses, URLs, referrers, and user-agent strings. The malware also contains a hidden command channel triggered through a request for a fake image path: /favorite_list_2x_m500_ico.jpg . When the attacker sends a specially crafted r

3. update from securityweek.com

   North Korean Hackers Deploy New Linux Espionage Toolkit

   securityweek.com · 36d ago · September 7th, 2026

   Designed for long-term surveillance, the framework consists of a HAProxy instance called ‘ted backdoor’ and trojanized versions of tools such as ‘agetty’, ‘atd’, ‘crond’, ‘polkitd’, and ‘sshd’. The toolkit supports remote command execution, credential harvesting, and script injection into web traffic, enabling attackers to spy on victims for long periods of time without detection. According to Rapid7, the framework is deeply integrated within the target infrastructure, with the ted backdoor being compiled as part of the HAProxy version 2.8.12 running on the victim’s environment. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected,” the cybersecurity firm explains. Likely in use since late 2024, when the first involved HAProxy iteration was released, the toolkit also uses a curl-based RAT, an SSH keylogger, and a stager. Initial access to an edge server was obtained through the exploitation of a Groupware login portal vulnerability. The SSH keylogger, which also serves as a staging server, was used for credential harvesting, enabling lateral movement to internal systems. “The stager checks for the presence of either cro

4. update from cyber.netsecops.io

   📰 North Korean Hackers Implant Backdoor Directly into HAProxy Source Code North Korea-linked hackers embed 'ted backdoor' directly into HAPr

   cyber.netsecops.io · 35d ago · September 8th, 2026

   📰 North Korean Hackers Implant Backdoor Directly into HAProxy Source Code North Korea-linked hackers embed 'ted backdoor' directly into HAPr

   via Mastodon https://cyber.netsecops.io/articles/north-korean-hackers-implant-backdoor-in-haproxy-source-code/?utm_source=mastodon&utm_medium=social&utm_campaign=daily