Ted Backdoor Trojanizes HAProxy Builds to Intercept Web Traffic

Sat, 05 Sep 2026 13:51:48 +0000

Engineer — Learn: No HAProxy vulnerability is involved — attackers needed prior code execution to recompile and replace the binary. This illustrates why runtime binary integrity checks (e.g., file hashing, dm-verity, or package-manager verification) on critical reverse-proxy binaries matter; no immediate patching action required.
SOC/IR — Learn: The technique — compiling a backdoor directly into a modified HAProxy binary — is a stealthy persistence method worth understanding, but no IOCs, ATT&CK mappings, or broader campaign details are available from this report to act on today.
Leader — Skip

Haproxy on CuraSec