Subverting Edge Load Balancers: Ted Backdoor Implants Custom HAProxy Builds to Intercept Ingress Traffic

Executive Summary

During early September 2026, the Encrygma Threat Intel Unit evaluated several emerging attack vectors, notably the discovery of the 'Ted' backdoor embedded inside victims' custom HAProxy builds. Rather than relying solely on traditional operating system-level persistence, adversaries are directly weaponizing edge networking binaries to intercept raw web traffic and siphon credentials before transport-layer security or web application firewall processing. Coupled with recent observations of threat actors utilizing anomalous Dead Drop Resolvers (DDR)—such as hijacking remote FTP banners to stage remote access trojans (including E4del and PINHOLE)—adversaries demonstrate an escalating sophistication in proxy manipulation and evasive command routing. Defensive postures must prioritize perimeter binary integrity checks, rigorous memory auditing, and monitoring of edge tier protocol anomalies.

Background & Context

Adversary tradecraft across the third quarter of 2026 has been marked by an aggressive evasion of standard Endpoint Detection and Response (EDR) instrumentation. As demonstrated in CrowdStrike 2026 Global Threat Report telemetry reporting that over 82% of enterprise detections now feature malware-free or edge-resident tactics, threat actors increasingly focus on unmonitored infrastructure. Attackers frequently bypass conventional defensive tiers by operating within trusted edge appliances or utilizing legitimate services as operational proxies.

Recent intrusion campaigns highlight two convergent trends: upstream edge component compromise and alternative C2 channel concealment. While initial access brokers frequently deliver modern stealers and loaders (such as Amatera via WordlistLoader and SynkLoader) using ClickFix-style verification lures, secondary stages immediately establish covert access. By modifying network proxy binaries at source or build time, adversaries create blind spots that render traditional perimeter inspection ineffective.

Analysis

Binary Tampering and HAProxy Hooking: The Ted Backdoor

Reverse engineering of the recently documented Ted backdoor reveals a purpose-built binary modification strategy targeting Linux enterprise environments. Rather than deploying an independent daemon that generates anomalous execution artifacts, the operators behind Ted patch and recompile custom HAProxy instances.

1. In-Memory Traffic Interception: The implant injects hooks directly into HAProxy's HTTP request-parsing event loops. By hooking the ingress handling functions, Ted evaluates incoming requests matching specific cryptographic headers or designated URI parameters.
2. Payload Execution and Exfiltration: If a matching packet is processed, the backdoor intercepts session tokens, basic authentication headers, and cryptographic keys before forwarding the cleansed payload down to backend application clusters. This completely evades internal application-layer logging.
3. C2 via Steganographic Egress: Command triggering does not require typical listening ports; inbound management traffic blends with production HTTPS transactions, effectively rendering external firewall rules and typical intrusion prevention signatures blind to the implant's presence.

Novel Dead Drop Mechanisms: FTP Banner Resolution

Simultaneously, tactical innovations in remote access trojan distribution have emerged through families such as E4del and PINHOLE, as reported in Threat Intelligence — Latest News, Reports & Analysis | The Hacker News. These intrusions deploy lightweight stagers designed to evade automated domain-reputation engines:

• Instead of querying standard DNS TXT records, GitHub gists, or paste sites, the stager opens an unauthenticated connection to preconfigured public FTP servers.
• The stager extracts command strings and base64-encoded second-stage endpoints directly from the server's RFC 959 welcome banner string.
• Because connecting to FTP ports (or passive-mode ranges) to read service banners does not trigger typical HTTP inspect alerts, malware loaders obtain dynamic C2 pointers without maintaining persistent external beaconing sockets.

Initial Delivery via ClickFix & WordlistLoader

Complementing these edge and proxy tactics is the widespread operationalization of ClickFix (FakeCaptcha) social engineering frameworks. Recent telemetry from Cybersecurity Blog | Daily Threat Intelligence News | RoboCop™ indicates that delivery chains using WordlistLoader and SynkLoader abuse user-executed PowerShell scripts masquerading as browser verification steps. These loaders serve as the primary wedge, harvesting preliminary host credentials before handing access off to operators who escalate into hypervisor and edge gateway manipulation.

Key Findings

• Edge Ingress Interception: The Ted backdoor establishes persistence by recompiling or modifying edge HAProxy binaries, allowing unlogged credential and token harvesting.
• Protocol Banner Exploitation: Threat actors are operationalizing raw FTP welcome banners as Dead Drop Resolvers to hide staging infrastructure from web-centric inspection appliances.
• Proliferation of ClickFix Chains: Initial access campaigns increasingly deploy WordlistLoader and SynkLoader via ClickFix templates, demonstrating high conversion rates against endpoint defenses.
• Malware-Free and Custom-Tool Saturation: Multi-stage intrusion sets rely on legitimate administration utilities and specialized compilation environments to prevent static string detection.

Attribution & Confidence

Encrygma Threat Intel Unit tracks the deployment of the Ted backdoor with moderate confidence as the activity of an advanced persistent threat (APT) cluster specializing in corporate espionage and initial broker handoffs. The level of engineering required to inject cleanly into HAProxy event loops mirrors state-nexus operations, such as Iranian or Chinese clusters (e.g., Nimbus Manticore or SilkParasite tooling variants noted in recent months). However, the modular loaders and ClickFix delivery networks operate under a cybercrime-as-a-service model, suggesting an operational pipeline where initial access brokers sell network entry to specialized state-sponsored or ransomware groups.

Defensive Recommendations

To counter binary compromise, anomalous C2 channels, and initial loader deployment, organizations should immediately execute the following defensive measures:

1. Edge Binary Verification & Golden Image Auditing: Deploy automated file integrity monitoring (FIM) across all production reverse proxies, load balancers, and gateways (HAProxy, NGINX, Envoy). Hash binaries against trusted repository builds and implement cryptographically signed code validation before deployment into ingress tiers.
2. Inspect Egress FTP and Non-Standard Protocols: Block unauthenticated outbound FTP connections (ports 20/21) from workstation subnets. Where FTP is strictly required, terminate connections at a stateful proxy that inspects service banner strings for encoded payloads or irregular characters.
3. Harden PowerShell Execution Against ClickFix: Restrict PowerShell execution via AppLocker or Windows Defender Application Control (WDAC) in Constrained Language Mode to interrupt clipboard-injected commands common in ClickFix and WordlistLoader infections.
4. Monitor Process Memory Patterns: Implement behavioral endpoint sensors configured to flag runtime memory alterations within long-running network daemons, specifically looking for unmapped memory segments and patched function pointers in production proxies.

Outlook

Adversaries will increasingly migrate their payloads directly into the software building blocks of critical networking infrastructure. As standard host and cloud endpoints gain enhanced behavioral protection, edge systems—particularly reverse proxies, API gateways, and custom network appliances—will remain premier focal points for covert data collection. Defending organizations must shift perimeter strategies from simply checking external IP addresses to thoroughly validating internal system binaries and application dependencies.