Trojanized HAProxy binary with embedded 'ted' backdoor

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects the presence of a malicious HAProxy binary (version 2.8.12) that has been recompiled with an embedded 'ted' plugin. The plugin is designed to intercept and manipulate web traffic, as evidenced by specific strings related to pipe file handling, logging, and registration operations found within the binary.