TraderTraitor (Jade Sleet) backdoors resurface on a non-cryptocurrency IT-services firm in a campaign that delivers malware through weaponized Terraform provider lockfiles, resolving C2 through a Nostr-relay dead drop
SentinelLabs: the same DPRK backdoors from a $292M crypto theft resurface on a victim with no crypto ties, in a campaign that uses poisoned Terraform lockfiles
Analysis
SentinelLabs hunted its telemetry for the FLATROOF (also known as macOS.Gaslight) and ROOFDECK macOS backdoors first disclosed in April 2026's USD 292 million LayerZero/KelpDAO cryptocurrency theft, and found an unrelated victim carrying the same implants: a small India-based IT-services provider with no cryptocurrency exposure, compromised through a single Apple Silicon MacBook belonging to a DevOps engineer (SentinelOne SentinelLabs, 2026-09-18). The lure follows DPRK's established "Contagious Interview" pattern: fake job-interview GitHub repositories themed as infrastructure-engineering coding challenges each carry a weaponized .terraform.lock.hcl pointing to a typosquatted, attacker-controlled Terraform provider registry impersonating HashiCorp's own naming. Because Terraform treats the lockfile's declared provider source as authoritative, running terraform init against the poisoned lockfile causes Terraform itself to download and execute the attacker's provider module in place of the genuine HashiCorp one. SentinelLabs cannot prove how this victim's backdoors were delivered: both were on disk by March 18, and the victim cloned a lure repository only on April 13 (SentinelOne SentinelLabs, 2026-09-18).
On the victim host, both backdoors sat dormant on disk from March 18 to March 29, 2026, then launched the moment the developer opened a specific Cursor IDE workspace: the Cursor process itself spawned both implants directly, which began beaconing to their command-and-control servers within two seconds, before FLATROOF stripped the macOS quarantine attribute from ROOFDECK and set its executable bit moments later, a Gatekeeper bypass. FLATROOF is a Rust ARM64 backdoor supporting shell, kill, upload and stop commands, paired with a Python data-harvesting module that pulls Chrome/Brave/Firefox/Safari data, Terminal history, installed-application lists, ps aux output, system_profiler output and a raw copy of login.keychain-db, exfiltrated via a hardcoded Telegram bot. ROOFDECK is the more capable second-stage implant: on first run it queries a public Nostr relay-status API plus a hardcoded relay list, searches Nostr relays for an operator profile matching a configured public key, and reads that profile's "website" field as its live command-and-control URL, a decentralized dead-drop resolver that survives takedown of any single C2 domain. A third stage later replaced both original implants and beaconed intermittently to a separate C2 until 2026-06-01, the last beacon in SentinelLabs' collected telemetry (SentinelOne SentinelLabs, 2026-09-18).
Triage: developers legitimately run terraform init against new or unfamiliar repositories constantly, so the command itself is not the signal: the discriminator is the lockfile's declared provider source pointing to a domain that is not registry.terraform.io or a known private registry the organization operates.
Cited evidence
Unlike the previous high-profile victim, this target was a much smaller organization in the IT services industry.
When the victim runs terraform init with the weaponized lockfile in place, Terraform treats the custom provider as the source of truth, resulting in Terraform downloading and executing the malicious provider modules.
When found, it reads the website field of the profile and uses that as its C2 URL.
a trojanized Terraform provider that executes malicious code as soon as Terraform loads the provider
Updates4
SentinelLabs cannot prove how this victim's backdoors were delivered: both were on disk by March 18 and ran from March 29, while the victim cloned a lure repository only on April 13 (SentinelOne SentinelLabs, 2026-09-18). The weaponized Terraform lockfile is the campaign's documented delivery method for its lure repositories, not this victim's proven initial access (SentinelOne SentinelLabs, 2026-09-18).
Zscaler ThreatLabz reports a July 2026 campaign that it suspects is TraderTraitor, citing substantial overlap in tactics and targeting but no code, infrastructure or cryptographic links sufficient for attribution with high confidence, in which a Go-built Terraform provider that poses as an AWS provider executes malicious code the moment Terraform loads the plugin: it writes a run-once marker in the temporary directory, downloads a Bash loader from a lookalike of a HashiCorp domain, starts it through a detached sh -c child and keeps behaving like a normal provider (Zscaler ThreatLabz, 2026-10-08). The loader runs on macOS, Linux and Windows with a Unix-like shell, picks a payload by operating system and CPU architecture and recovers an encrypted executable appended after a marker in a file named like a web font; on macOS it removes the quarantine attribute and applies an ad-hoc signature (Zscaler ThreatLabz, 2026-10-08). The delivered FLATROOF is a Rust backdoor with Telegram Bot API, GitHub-polling and HTTP-webhook command channels, persistence as a service on Linux, a zlogout entry on macOS and a registry entry on Windows, and Python stealers for browser data, cookies, keychain or Credential Manager entries, shell history and wallet-extension data; it drops ROOFDECK, which finds its server through a local configuration, then an RSA-signed Pastebin dead drop, with Nostr profile metadata only as the fallback, so its order of resolvers differs from the Nostr-first behaviour SentinelLabs describes above (Zscaler ThreatLabz, 2026-10-08). Zscaler does not know how the provider reached the victim, and notes that SentinelLabs independently reported related activity with weaponized Terraform projects (Zscaler ThreatLabz, 2026-10-08).
The telemetry that follows from the provider path is the Terraform provider plugin process making an HTTPS download from a host that is not the Terraform registry, writing a script to the temporary directory and starting it through sh -c; Zscaler advises restricting untrusted Terraform providers, verifying provider checksums and monitoring unexpected process activity (Zscaler ThreatLabz, 2026-10-08).
Zscaler's loader selects FLATROOF payloads for macOS, Linux and Windows, and FLATROOF ultimately drops the ROOFDECK backdoor; Zscaler identifies Windows and macOS variants of ROOFDECK (Zscaler ThreatLabz, 2026-10-08). The 2026-10-09 note said both families were delivered on all three platforms.
Reading an operator's Nostr profile "website" field as the command-and-control URL is the behavior of the sample SentinelLabs analysed (SentinelOne SentinelLabs, 2026-09-18). In the ROOFDECK variants Zscaler describes, Nostr is the last of three resolvers, after the locally stored address and a signed, encrypted Pastebin address, and its profile metadata is used "to locate the current dead-drop Pastebin URL" rather than the server itself (Zscaler ThreatLabz, 2026-10-08).
Sources2
Revision history
- Published 2026-09-21T0410Z-intel
- Correction 2026-09-30T0639Z-audit
Priority recalibrated from high to notable: a DPRK developer-targeting campaign aimed at crypto firms, not Swiss public bodies. A defanged hostname of the public Nostr relay-status service in the text is replaced by a description of the service. The sourcing note is rewritten as plain provenance. The title, headline and summary no longer present the weaponized Terraform lockfile as this victim's delivery method: SentinelLabs cannot prove how the backdoors arrived, which were on disk weeks before the victim cloned a lure repository. An evidence quote is trimmed to drop a relay-service hostname. A claim that the third-stage implant went silent is narrowed to SentinelLabs' last observed beacon, and attacker-chosen lure repository names are removed.
Changed: priority body sourcing_note title headline summary evidence
- Update 2026-10-09T0255Z-intel
Zscaler ThreatLabz (2026-10-08) independently reports a July 2026 trojanized Terraform provider binary that executes at plugin load and delivers FLATROOF and ROOFDECK on macOS, Linux and Windows, with Telegram, GitHub and webhook command channels and a signed Pastebin dead drop alongside the Nostr fallback; the Terraform delivery path now has a second form, and the malware family a second publisher.
Changed: summary techniques entities affected_products sources evidence verification sourcing_note body
- Correction 2026-10-11T1307Z-audit
Zscaler describes FLATROOF payloads for macOS, Linux and Windows that drop the ROOFDECK backdoor, and identifies ROOFDECK variants only for Windows and macOS; the summary had said both families were delivered on all three platforms. The macOS detection sentence gains its SentinelLabs citation.
Changed: summary body
- Improvement 2026-10-21T0800Z-audit
The summary no longer presents Nostr-based command-and-control resolution as universal: reading a Nostr profile's "website" field as the C2 URL is SentinelLabs' sample, while Zscaler's ROOFDECK variants try a local configuration and a signed Pastebin dead drop first and use Nostr metadata only to locate the current Pastebin URL.
Changed: summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.