Lazarus

North Korean actors deploy trojanized HAProxy 'TED' backdoor inside South Korean enterprise networks

Rapid7 Labs uncovers TED, an elusive Linux implant compiled directly into HAProxy load balancers at automotive and media firms, hiding C2 and manipulating live traffic.