New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and

Report facts: Researchers identified a previously undocumented Linux toolkit, dubbed 'ted', that was compiled directly into trojanized HAProxy load balancers at two South Korean organizations, allowing attackers to intercept web traffic and serve altered pages to selected visitors. The article states this is not a native HAProxy vulnerability; the implant must be installed via prior code execution on the host, indicating compromise of the software supply chain or deployment pipeline for these HAProxy builds. RealGround analysis: Although the case is not specific to AI, it highlights the risk of attackers inserting backdoors into critical infrastructure binaries, a pattern directly applicable to AI model servers, inference gateways, and MLOps pipelines. Organizations using AI should harden their build and deployment chains with SBOMs, reproducible builds, and integrity checks, and include HAProxy-like components in AI security readiness assessments, since a trojanized proxy could silently tamper with AI traffic, logs, or training data.