Trojanized HAProxy Load Balancers Deploy Previously Undocumented 'ted' Backdoor in South Korea

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and administrative access to replace the legitimate load balancer binary with a compromised version. The discovery was reported by The Hacker News on September 4, 2026. Analysis of the compromised binaries revealed the 'ted' implant is designed to manipulate web traffic in transit. While the exact initial access vector remains unclear, the requirement for code execution suggests the attackers gained administrative or root-level access to the affected systems prior to deployment. The two targeted organizations in South Korea operate in sectors not explicitly identified in the initial reporting. The 'ted' implant functions by intercepting web traffic passing through the HAProxy load balancer. Upon detecting connections matching specific criteria, the implant can alter the content of web pages served to visitors. This capability could be leveraged for credential theft, data exfiltration, or reputational damage by serving phishing pages or modified content to targeted users. Security experts emphasize that this incident represents a supply-chain or build-system compromise rather than a flaw in the HAProxy software itself. The HAProxy open-source project has not issued a security advisory or patch related to this activity, as the malicious binaries were constructed outside of official distribution channels. Organizations using HAProxy are advised to verify the integrity of their binaries using checksums or digital signatures and to audit their build and deployment processes for unauthorized modifications.