CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Permanent story citation

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 5718

As cited

Copy frozen at (site build).

threat intel

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Researchers identified a previously unknown Linux backdoor named ted that was compiled into trojaned HAProxy builds deployed at two South Korean organizations. The implant intercepted web traffic and modified content served to selected users, requiring prior code execution on the host to install.

Why it matters: Organizations running HAProxy should verify the integrity of their binaries and monitor for unauthorized modifications, as this attack method bypasses normal update channels and affects load balancers handling sensitive web traffic.

Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary