As cited
Copy frozen at (site build).
threat intel
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Researchers identified a previously unknown Linux backdoor named ted that was compiled into trojaned HAProxy builds deployed at two South Korean organizations. The implant intercepted web traffic and modified content served to selected users, requiring prior code execution on the host to install.
Why it matters: Organizations running HAProxy should verify the integrity of their binaries and monitor for unauthorized modifications, as this attack method bypasses normal update channels and affects load balancers handling sensitive web traffic.
- Source published
- First seen by Cybersecurity Tracker