aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, North Korean state-sponsored actors deployed a sophisticated backdoor called 'Ted' by compromising HAProxy load balancers at two South Korean organizations in the automotive and media sectors. The attackers replaced legitimate HAProxy binaries with trojanized versions containing embedded malware that intercepted web traffic and served altered pages to selected visitors. The implant operated covertly by handling command-and-control requests without reaching backend servers, erasing traces from connection logs and statistics. The attack toolkit included additional trojans targeting system binaries like sshd and crond, along with a companion remote access trojan called curlRAT that maintained persistent access to compromised systems.

This incident highlights the evolving sophistication of supply chain attacks where legitimate infrastructure components are weaponized to establish persistent footholds in critical networks. The attack demonstrates advanced techniques for traffic manipulation and steganographic communication that bypass traditional security controls focused on network perimeter defense.

Why This Matters Now

State-sponsored actors are increasingly targeting critical infrastructure through supply chain compromises and traffic manipulation techniques that evade traditional security controls, requiring organizations to implement zero-trust architectures with comprehensive traffic inspection and behavioral analysis capabilities.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The backdoor was compiled directly into trojanized HAProxy binaries, handling C2 requests without reaching backend servers and erasing connection traces from load balancer statistics and logs.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have constrained this North Korean APT's movement across virtualized infrastructure by enforcing workload segmentation and controlling east-west traffic flows. The attack's blast radius and lateral expansion through compromised load balancers would likely have been significantly reduced.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial compromise through exposed portals would likely still occur, but CNSF micro-segmentation could have limited the attacker's ability to expand beyond the initially compromised workload boundary

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: While local privilege escalation may still succeed, zero trust segmentation would likely restrict the scope of compromised workloads and limit access to sensitive network segments even with elevated privileges

Lateral Movement

Control: East-West Traffic Security

Mitigation: Lateral movement across virtualized infrastructure would likely be significantly constrained by east-west traffic inspection and policy enforcement, limiting the attacker's ability to deploy beacons across multiple hosts

Command & Control

Control: Multicloud Visibility & Control

Mitigation: C2 communications through compromised load balancers would likely be detected and constrained through enhanced visibility into traffic flows and anomalous connection patterns across the multicloud environment

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration through compromised web infrastructure would likely be constrained by egress policies that monitor and control outbound traffic flows, limiting the attacker's ability to transfer sensitive information

Impact (Mitigations)

Residual impact would likely be confined to initially compromised web assets, with reduced ability to expand watering hole operations across segmented network boundaries and limited scope for sustained intelligence collection

Impact at a Glance

Affected Business Functions

  • Web Load Balancing Services
  • Customer Web Portal Access
  • Media Content Delivery
  • Automotive Customer Services
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $150,000

Data Exposure

Compromised web traffic interception capabilities affecting customer browsing sessions, potential exposure of authentication credentials through trojanized SSH daemon, and selective content manipulation targeting specific visitors based on IP address and user-agent filtering.

Recommended Actions

  • • Deploy Zero Trust Segmentation with microsegmentation policies to prevent lateral movement between compromised systems and critical infrastructure components like load balancers
  • • Implement Egress Security & Policy Enforcement to detect and block unauthorized outbound communications to attacker C2 domains and prevent data exfiltration through compromised web traffic
  • • Enable Multicloud Visibility & Control with centralized monitoring to detect anomalous traffic patterns, connection counter manipulations, and suspicious automation accessing critical network infrastructure
  • • Deploy Threat Detection & Anomaly Response capabilities to establish behavioral baselines for system binaries and detect unauthorized modifications to critical services like HAProxy, SSH, and cron daemons
  • • Implement East-West Traffic Security controls to monitor and restrict service-to-service communications, ensuring compromised load balancers cannot freely access backend systems or manipulate internal traffic flows

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image