TraderTraitor (Jade Sleet) compromises a non-cryptocurrency IT-services firm via a weaponized Terraform provider lockfile, resolving C2 through a Nostr-relay dead drop
SentinelLabs: the same DPRK backdoors from a $292M crypto theft resurface on a victim with no crypto ties, delivered through a poisoned Terraform lockfile
Analysis
SentinelLabs hunted its telemetry for the FLATROOF (also known as macOS.Gaslight) and ROOFDECK macOS backdoors first disclosed in April 2026's USD 292 million LayerZero/KelpDAO cryptocurrency theft, and found an unrelated victim carrying the same implants: a small India-based IT-services provider with no cryptocurrency exposure, compromised through a single Apple Silicon MacBook belonging to a DevOps engineer (SentinelOne SentinelLabs, 2026-09-18). The lure follows DPRK's established "Contagious Interview" pattern: fake job-interview GitHub repositories themed as infrastructure-engineering coding challenges (named Northwind-IAC, novacart-interview, terraform-candidate-repo) each carry a weaponized .terraform.lock.hcl pointing to a typosquatted, attacker-controlled Terraform provider registry impersonating HashiCorp's own naming. Because Terraform treats the lockfile's declared provider source as authoritative, running terraform init against the poisoned lockfile causes Terraform itself to download and execute the attacker's provider module in place of the genuine HashiCorp one.
On the victim host, both backdoors sat dormant on disk from March 18 to March 29, 2026, then launched the moment the developer opened a specific Cursor IDE workspace: the Cursor process itself spawned both implants directly, which began beaconing to their command-and-control servers within two seconds, before FLATROOF stripped the macOS quarantine attribute from ROOFDECK and set its executable bit (a Gatekeeper bypass) moments later. FLATROOF is a Rust ARM64 backdoor supporting shell, kill, upload and stop commands, paired with a Python data-harvesting module that pulls Chrome/Brave/Firefox/Safari data, Terminal history, installed-application lists, ps aux output, system_profiler output and a raw copy of login.keychain-db, exfiltrated via a hardcoded Telegram bot. ROOFDECK is the more capable second-stage implant: on first run it queries the public api.nostr[.]watch/v1/online endpoint plus a hardcoded relay list, searches Nostr relays for an operator profile matching a configured public key, and reads that profile's "website" field as its live command-and-control URL, a decentralized dead-drop resolver that survives takedown of any single C2 domain. A third stage later replaced both original implants and kept beaconing to a separate C2 for over a month before going silent.
Triage: developers legitimately run terraform init against new or unfamiliar repositories constantly, so the command itself is not the signal; the discriminator is the lockfile's declared provider source pointing to a domain that is not registry.terraform.io or a known private registry the organization operates.
Cited evidence
Unlike the previous high-profile victim, this target was a much smaller organization in the IT services industry.
When the victim runs terraform init with the weaponized lockfile in place, Terraform treats the custom provider as the source of truth, resulting in Terraform downloading and executing the malicious provider modules.
Upon first execution, it pulls live Nostr relays from api.nostr[.]watch/v1/online and combines them with a hardcoded relay list belonging to legitimate Nostr services, then searches the relays for an operator's profile on the Nostr network based on a public profile key given in the configuration file nostr_public_keys. When found, it reads the website field of the profile and uses that as its C2 URL.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.