Rapid7 links HAProxy backdoor toolkit to North Korean actors

Rapid7 Labs found a previously undocumented Linux toolkit compiled into trojanized HAProxy load balancers at two South Korean organizations. The implant, called ted in debug strings, intercepted traffic and could serve altered pages to selected visitors while concealing command-and-control requests from HAProxy counters. Rapid7 attributed the activity to North Korean state-sponsored actors with medium confidence and said more evidence is needed for a definitive assessment.