Skip to navigation

Threat reportAPTTL-2026-5505

TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties

highACTIVE

SentinelOne Labs reports an additional TraderTraitor (UNC4899 / Jade Sleet) victim, a DevOps engineer's Apple Silicon Mac at an India-based IT services provider with no cryptocurrency ties, infected with the FLATROOF (macOS.Gaslight) and ROOFDECK ARM64 Rust backdoors. The campaign lures developers with fake job-interview projects carrying weaponized .terraform.lock.hcl files that point Terraform at typosquatted HashiCorp registries; the host held cloud credentials and source-control tokens. First disclosed .

Key facts for TraderTraitor FLATROOF backdoors

IdentifiersTL-2026-5505
Also known asmacOS.Gaslight, Contagious Interview-style fake job campaign
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsApple macOS (Apple Silicon / ARM64 developer workstations); HashiCorp Terraform (dependency handling abused, not a vulnerability)
AttributionTraderTraitor (high confidence)
Nation-state nexusNorth Korea
MITRE ATT&CK techniquesT1036.005 Match Legitimate Resource Name or Location, T1057 Process Discovery, T1059.004 Unix Shell, T1059.006 Python, T1070.004 File Deletion, T1071.001 Web Protocols, T1082 System Information Discovery, T1102.001 Dead Drop Resolver, T1195.002 Compromise Software Supply Chain, T1204.002 Malicious File, T1518 Software Discovery, T1543.001 Launch Agent and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsit services, managed service providers, cryptocurrency, finance, cloud infrastructure
Target regionsindia, Global
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for TraderTraitor FLATROOF backdoors

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5505 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TraderTraitor Terraform Registry Typosquat Lookup — Weaponized Lock File Delivery

Behaviour-first detection of DNS resolution for hashicorp-* lookalike registries (registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io) used by TraderTraitor (TL-2026-5505) weaponized .terraform.lock.hcl files. terraform init against these registries runs attacker-controlled providers that deploy FLATROOF and ROOFDECK on developer Macs.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1204.002, T1566.002
  • Data sources: stream:dns, dns_logs, defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=network sourcetype="stream:dns" earliest=-24h
```TraderTraitor lock files pin providers on hashicorp lookalike registries```
| eval qname=lower(rtrim(coalesce(mvindex(query,0),""),"."))
| where match(qname,"^registry\\.hashicorp-(aws\\.com|aws\\.io|terraform\\.io)$") OR match(qname,"(^|\\.)hashicorp-[a-z0-9-]+\\.[a-z0-9.-]+$")
| stats count min(_time) as first_seen max(_time) as last_seen values(qname) as lookalike_domains by src_ip
| convert ctime(first_seen) ctime(last_seen)
| table src_ip lookalike_domains count first_seen last_seen

Microsoft KQL

let known = dynamic(["registry.hashicorp-aws.com","registry.hashicorp-aws.io","registry.hashicorp-terraform.io"]);
let lookalike = @"(^|[./])hashicorp-[a-z0-9-]+\.[a-z0-9.-]+";
union isfuzzy=true
    (DeviceNetworkEvents
     | where Timestamp > ago(24h) and isnotempty(RemoteUrl)
     | project TimeGenerated = Timestamp, Source = DeviceName, Name = tolower(RemoteUrl), Process = InitiatingProcessFileName, CmdLine = InitiatingProcessCommandLine),
    (DnsEvents
     | where TimeGenerated > ago(24h)
     | project TimeGenerated, Source = ClientIP, Name = tolower(Name), Process = "", CmdLine = "")
| where Name has_any (known) or Name matches regex lookalike
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Source, Name, Process, CmdLine

Sigma

title: TraderTraitor Terraform Registry Typosquat DNS Lookup
id: 5c1e2f10-7a3b-4d5e-9b01-0a5505000001
status: experimental
description: Detects DNS lookups for hashicorp lookalike registries pinned by weaponized .terraform.lock.hcl files in fake job-interview repositories.
references:
  - https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
  - https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1204.002
  - attack.t1566.002
logsource:
  category: dns
detection:
  selection_ioc:
    query|endswith:
      - 'registry.hashicorp-aws.com'
      - 'registry.hashicorp-aws.io'
      - 'registry.hashicorp-terraform.io'
  selection_lookalike:
    query|re: '(^|\.)hashicorp-[a-z0-9-]+\.[a-z0-9.-]+$'
  condition: 1 of selection_*
falsepositives:
  - Internal mirrors or vendor domains that legitimately begin with hashicorp-
  - Security researchers analysing the campaign
level: high

Known false positives:

  • Internal artifact mirrors or vendor domains whose label legitimately starts with hashicorp-
  • Security teams investigating the campaign

Tuning notes: Replace index and sourcetype with your DNS source (Infoblox, Zeek, Umbrella) keeping a qname field. Allowlist known first-party hashicorp-* domains. Pivot hits to the host's terraform init history and the cloned repository.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TraderTraitor ROOFDECK/FLATROOF Launch With Chromium Renderer Argument From Non-App Path · unlock with TL Creds
  • TraderTraitor FLATROOF Gatekeeper Bypass and Implant Child Process Activity · unlock with TL Creds
  • TraderTraitor ROOFDECK Dead Drop, Nostr and Telegram C2 From Non-App Processes · unlock with TL Creds
  • TraderTraitor Trojanized Terraform Provider terraform-provider-awsbeta Loader Execution · unlock with TL Creds
  • TraderTraitor FLATROOF Keychain, Browser Store and Shell History Harvesting · unlock with TL Creds
  • TraderTraitor FLATROOF/ROOFDECK Implant Files, Config, IPC Pipe and Hashes · unlock with TL Creds
  • TraderTraitor ROOFDECK LaunchAgent Persistence and loginwindow Masquerade · unlock with TL Creds
  • TraderTraitor FLATROOF/ROOFDECK C2 Infrastructure Communication · unlock with TL Creds

Indicators of compromise for TraderTraitor FLATROOF backdoors

As of 2026-11-07, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5505.

Sample indicators (3 of 29)

  • IP address: 176.97.114[.]232
  • Domain: technicais[.]sytes[.]net
  • URL: hxxps://pastebin[.]com/raw/3yptBDhL

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

29 indicators of compromise · unlock with TL Creds. Compare plans

How TraderTraitor FLATROOF backdoors works

Following public disclosure of the TraderTraitor intrusion at LayerZero Labs (April 2026), SentinelOne Labs identified a second victim carrying the same macOS backdoors: an Apple Silicon MacBook used by a DevOps engineer at an unnamed India-based IT services provider. The machine held cloud credentials and VCS personal access tokens and was regularly used with AWS, OVH and OpenStack. This is expanded targeting beyond cryptocurrency firms; a managed-service engineer's workstation is a potential foothold into every client estate it serves.

The backdoors are a two-stage chain. FLATROOF (tracked by SentinelOne as macOS.Gaslight) is an ARM64 Rust first-stage dropped as 'SystemUpdate' at ~/Library/com.apple.iTunesCloud/SystemUpdate. It supports id, shell, upload, kill and stop commands, bundles a Python harvester for Chrome, Brave, Firefox and Safari data, collects shell history, process lists, installed applications and system profiles, copies login.keychain-db, exfiltrates over the Telegram Bot API, and strips the com.apple.quarantine attribute from ROOFDECK (Gatekeeper bypass). ROOFDECK is the second-stage ARM64 Rust implant, masqueraded as 'iSync' (~/Library/com.apple.internal.ck/iSync) and later a stripped variant named 'loginwindow' (~/Library/com.apple.appleaccountd/loginwindow). It reads its config from ~/.config/.repl_history, discovers its C2 URL from the 'website' field of an operator Nostr profile queried through public relays, accepts RSA-signed commands, re-implements file operations natively, offers interactive and reverse shells, clipboard access and encrypted archive creation, taps an IPC pipe at /private/tmp/.pipe-airway, and persists via a LaunchAgent (loginwindow.plist, RunAtLoad) launched with a --type=renderer argument to mimic a Chromium helper.

Timeline from the victim host: both implants were on disk by 2026-03-18; on 2026-03-29 at ~05:00 they were launched with nohup using --type=renderer from a Cursor IDE session (a 'cloudshield' workspace) and began beaconing to multiple addresses; beaconing was gated on Cursor IDE sessions. On 2026-04-13 the engineer cloned a weaponized interview repository (terraform-candidate-repo) via GitHub Desktop; on 2026-04-20 a stripped ROOFDECK was staged and the original binaries deleted; the last C2 communication was 2026-06-01 and the malware was moved to Trash on 2026-06-17. Because the implants predate the documented lure by 26 days, independent analysis notes the initial delivery mechanism for this victim is unproven.

The campaign lure abuses normal Terraform dependency handling rather than a vulnerability: fake interview repositories (Northwind-IAC, novacart-interview, terraform-candidate-repo) ship a weaponized .terraform.lock.hcl that pins attacker-controlled providers on typosquatted registries (registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io), so terraform init executes attacker code. Zscaler ThreatLabz separately documented a suspected TraderTraitor trojanized Terraform provider (terraform-provider-awsbeta_v1.0.0) that fetches a bash loader (safari_updater), downloads encrypted payloads disguised as .woff font files, and deploys cross-platform FLATROOF builds (macOS, Linux, Windows) and ROOFDECK, with FLATROOF C2 over Telegram, GitHub polling and HTTP webhooks, and ROOFDECK C2 discovery via local config, RSA-signed Pastebin dead drops and Nostr metadata.

Cloud expansion: the source summary describes harvested API keys and privilege escalation used to expand into the victim's AWS and GCP environments. One independent analysis states that use of the cloud and source-control credentials was not confirmed in available endpoint telemetry, and that exfiltration and client impact are unknown. The SentinelOne article itself could not be fetched during research (HTTP 429), so SentinelOne-specific cloud details rest on the skeleton summary. The same backdoors were tied to the LayerZero compromise (116,500 rsETH, ~$292M stolen from the KelpDAO bridge) despite SSO, MFA and EDR. DPRK attribution is high confidence; the UNC4899 sub-cluster tie is medium confidence.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery

Execution

T1059.004 Unix Shell; T1059.006 Python; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link

Persistence

T1543.001 Launch Agent

Credential Access

T1552.003 Shell History; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

defense-impairment

T1553.001 Gatekeeper Bypass

Collection

T1560.001 Archive via Utility

Remediation for TraderTraitor FLATROOF backdoors

Immediate actions

  • Hunt macOS endpoints for the FLATROOF/ROOFDECK file paths, SHA-1 hashes, and LaunchAgents launched with --type=renderer that point to non-Chromium binaries
  • Block and alert on the listed C2 domains/IPs and the typosquatted hashicorp-aws / hashicorp-terraform registry domains
  • Rotate cloud credentials, VCS personal access tokens, SSH keys and keychain-stored secrets on any host where the implants are found
  • Review AWS/GCP/OVH audit logs for use of keys held on affected developer machines

Workarounds

  • Verify Terraform provider sources and lock files before running terraform init on third-party code
  • Monitor IDE (Cursor) child processes that start nohup binaries from ~/Library paths

Longer-term hardening

  • Run interview and coding-assessment projects only in disposable VMs or sandboxes
  • Use short-lived, least-privilege cloud credentials on developer workstations instead of long-lived keys
  • Segment engineering systems and restrict egress, including to Telegram Bot API, Nostr relays and Pastebin where not required
  • Alert on .terraform.lock.hcl files whose provider sources fall outside registry.terraform.io
  • Exercise incident response for malicious repositories and developer credential compromise

Affected and fixed versions

  • Apple — macOS (Apple Silicon / ARM64 developer workstations)
    Vulnerable versions: Not version-specific; user-execution and trust abuse
  • HashiCorp — Terraform (dependency handling abused, not a vulnerability)
    Vulnerable versions: Not version-specific; no vulnerability exploited

Timeline of TraderTraitor FLATROOF backdoors

  • FLATROOF (SystemUpdate) and ROOFDECK (iSync) hashes are present on the Apple Silicon Mac of a DevOps engineer at an India-based IT services provider.
  • Implants are launched via nohup with --type=renderer from a Cursor IDE session (cloudshield workspace) and begin beaconing to multiple C2 addresses; beaconing is gated on Cursor sessions.
  • The engineer clones the weaponized terraform-candidate-repo via GitHub Desktop, 26 days after the implants appeared; delivery for this victim remains unproven.
  • KelpDAO rsETH bridge attack (116,500 rsETH, ~$292M) is later tied to TraderTraitor's LayerZero Labs compromise using the same backdoors.
  • A stripped ROOFDECK variant (loginwindow) is staged and the original binaries are deleted.
  • Last observed C2 communication from the victim host.
  • The backdoor binary is moved to Trash on the victim host.
  • Earliest dated secondary analysis of SentinelOne Labs' report on FLATROOF/ROOFDECK on a non-crypto IT services victim.
  • SOC Prime publishes detection coverage for the TraderTraitor backdoors targeting victims outside the cryptocurrency sector.
  • Zscaler ThreatLabz publishes analysis of a trojanized Terraform provider delivering cross-platform FLATROOF and ROOFDECK, attributed to suspected TraderTraitor.

Sources cited for TraderTraitor FLATROOF backdoors

More from TraderTraitor

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats