A newly identified Linux malware, known as the Ted backdoor, has emerged within the compromised HAProxy load balancers of two South Korean entities. This backdoor, strategically embedded by attackers, intercepts web traffic to deliver manipulated web pages to specific users. The malware’s presence was uncovered by cybersecurity researchers at Rapid7, who have linked it with medium confidence to North Korean state-sponsored groups targeting South Korea’s automotive and media sectors.
Technical Insights into the Ted Backdoor
The Ted implant is cleverly named within the code, but it should not be misconstrued as a vulnerability in HAProxy itself. Instead, its installation demands unauthorized code execution on the host system and substitution of the HAProxy binary. This malware’s actions are stealthy, as it manages to erase command-and-control (C2) requests from the load balancer’s logs, leaving no trace in HAProxy’s connection statistics.
The backdoor operates by entering a specialized mode upon receiving a particular image path request. This action causes the load balancer to drop the connection from its statistics and write the command body to a temporary location. The response mimics regular web traffic, using a standard HTTP/1.0 200 OK header, allowing the attacker to perform various malicious activities including file transfers and remote command execution.
Implications and Attribution
Rapid7’s analysis indicates that the attackers possibly exploited a Groupware portal vulnerability for initial access, aligning with past reports of North Korean group Kimsuky targeting similar systems. The implant alters outgoing data by modifying content type and length, forcing a 200 status response, and removing headers that could reveal size discrepancies.
Rapid7 has not yet established a timeline for the attack or confirmed the initial entry method. However, the use of a trojanized sshd and other binaries like agetty and polkitd, along with a remote access trojan dubbed curlRAT, suggests a sophisticated operation. Indicators of compromise (IoCs) include several domain names and file paths, which, as of September 4, were no longer active.
Security Recommendations and Future Outlook
To mitigate the risk posed by the Ted backdoor, Rapid7 recommends rigorous network correlation, memory behavior analysis, and integrity checks of binaries. Although no specific detection rules were provided, these steps are crucial for identifying and neutralizing the threat. Furthermore, the continuous evolution of HAProxy versions suggests that upgrading alone will not remove the backdoor if already present.
As cybersecurity threats continue to evolve, organizations must remain vigilant and proactive in securing their infrastructure. The Ted backdoor serves as a stark reminder of the persistent and sophisticated tactics employed by state-sponsored actors, underscoring the need for comprehensive security measures and constant monitoring.
