# TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties

> SentinelOne Labs reports an additional TraderTraitor (UNC4899 / Jade Sleet) victim, a DevOps engineer's Apple Silicon Mac at an India-based IT services provider with no cryptocurrency ties, infected with the FLATROOF (macOS.Gaslight) and ROOFDECK ARM64 Rust backdoors. The campaign lures developers with fake job-interview projects carrying weaponized .terraform.lock.hcl files that point Terraform at typosquatted HashiCorp registries; the host held cloud credentials and source-control tokens.

- **Published:** 2026-11-07T10:31:46Z
- **Last reviewed:** 2026-11-07T10:31:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5505
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5505.png
- **ID:** TL-2026-5505
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** TraderTraitor (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Following public disclosure of the TraderTraitor intrusion at LayerZero Labs (April 2026), SentinelOne Labs identified a second victim carrying the same macOS backdoors: an Apple Silicon MacBook used by a DevOps engineer at an unnamed India-based IT services provider. The machine held cloud credentials and VCS personal access tokens and was regularly used with AWS, OVH and OpenStack. This is expanded targeting beyond cryptocurrency firms; a managed-service engineer's workstation is a potential foothold into every client estate it serves.

The backdoors are a two-stage chain. FLATROOF (tracked by SentinelOne as macOS.Gaslight) is an ARM64 Rust first-stage dropped as 'SystemUpdate' at ~/Library/com.apple.iTunesCloud/SystemUpdate. It supports id, shell, upload, kill and stop commands, bundles a Python harvester for Chrome, Brave, Firefox and Safari data, collects shell history, process lists, installed applications and system profiles, copies login.keychain-db, exfiltrates over the Telegram Bot API, and strips the com.apple.quarantine attribute from ROOFDECK (Gatekeeper bypass). ROOFDECK is the second-stage ARM64 Rust implant, masqueraded as 'iSync' (~/Library/com.apple.internal.ck/iSync) and later a stripped variant named 'loginwindow' (~/Library/com.apple.appleaccountd/loginwindow). It reads its config from ~/.config/.repl_history, discovers its C2 URL from the 'website' field of an operator Nostr profile queried through public relays, accepts RSA-signed commands, re-implements file operations natively, offers interactive and reverse shells, clipboard access and encrypted archive creation, taps an IPC pipe at /private/tmp/.pipe-airway, and persists via a LaunchAgent (loginwindow.plist, RunAtLoad) launched with a --type=renderer argument to mimic a Chromium helper.

Timeline from the victim host: both implants were on disk by 2026-03-18; on 2026-03-29 at ~05:00 they were launched with nohup using --type=renderer from a Cursor IDE session (a 'cloudshield' workspace) and began beaconing to multiple addresses; beaconing was gated on Cursor IDE sessions. On 2026-04-13 the engineer cloned a weaponized interview repository (terraform-candidate-repo) via GitHub Desktop; on 2026-04-20 a stripped ROOFDECK was staged and the original binaries deleted; the last C2 communication was 2026-06-01 and the malware was moved to Trash on 2026-06-17. Because the implants predate the documented lure by 26 days, independent analysis notes the initial delivery mechanism for this victim is unproven.

The campaign lure abuses normal Terraform dependency handling rather than a vulnerability: fake interview repositories (Northwind-IAC, novacart-interview, terraform-candidate-repo) ship a weaponized .terraform.lock.hcl that pins attacker-controlled providers on typosquatted registries (registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io), so terraform init executes attacker code. Zscaler ThreatLabz separately documented a suspected TraderTraitor trojanized Terraform provider (terraform-provider-awsbeta_v1.0.0) that fetches a bash loader (safari_updater), downloads encrypted payloads disguised as .woff font files, and deploys cross-platform FLATROOF builds (macOS, Linux, Windows) and ROOFDECK, with FLATROOF C2 over Telegram, GitHub polling and HTTP webhooks, and ROOFDECK C2 discovery via local config, RSA-signed Pastebin dead drops and Nostr metadata.

Cloud expansion: the source summary describes harvested API keys and privilege escalation used to expand into the victim's AWS and GCP environments. One independent analysis states that use of the cloud and source-control credentials was not confirmed in available endpoint telemetry, and that exfiltration and client impact are unknown. The SentinelOne article itself could not be fetched during research (HTTP 429), so SentinelOne-specific cloud details rest on the skeleton summary. The same backdoors were tied to the LayerZero compromise (116,500 rsETH, ~$292M stolen from the KelpDAO bridge) despite SSO, MFA and EDR. DPRK attribution is high confidence; the UNC4899 sub-cluster tie is medium confidence.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1059.006 Python
- T1543.001 Launch Agent
- T1553.001 Gatekeeper Bypass
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1552.003 Shell History
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TraderTraitor Terraform Registry Typosquat Lookup — Weaponized Lock File Delivery** (`TL-2026-5505-SPL-001`)

Behaviour-first detection of DNS resolution for hashicorp-* lookalike registries (registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io) used by TraderTraitor (TL-2026-5505) weaponized .terraform.lock.hcl files. terraform init against these registries runs attacker-controlled providers that deploy FLATROOF and ROOFDECK on developer Macs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.002, T1566.002
- **Data sources:** stream:dns, dns_logs, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=network sourcetype="stream:dns" earliest=-24h
```TraderTraitor lock files pin providers on hashicorp lookalike registries```
| eval qname=lower(rtrim(coalesce(mvindex(query,0),""),"."))
| where match(qname,"^registry\\.hashicorp-(aws\\.com|aws\\.io|terraform\\.io)$") OR match(qname,"(^|\\.)hashicorp-[a-z0-9-]+\\.[a-z0-9.-]+$")
| stats count min(_time) as first_seen max(_time) as last_seen values(qname) as lookalike_domains by src_ip
| convert ctime(first_seen) ctime(last_seen)
| table src_ip lookalike_domains count first_seen last_seen
````

### Microsoft KQL

```kql
let known = dynamic(["registry.hashicorp-aws.com","registry.hashicorp-aws.io","registry.hashicorp-terraform.io"]);
let lookalike = @"(^|[./])hashicorp-[a-z0-9-]+\.[a-z0-9.-]+";
union isfuzzy=true
    (DeviceNetworkEvents
     | where Timestamp > ago(24h) and isnotempty(RemoteUrl)
     | project TimeGenerated = Timestamp, Source = DeviceName, Name = tolower(RemoteUrl), Process = InitiatingProcessFileName, CmdLine = InitiatingProcessCommandLine),
    (DnsEvents
     | where TimeGenerated > ago(24h)
     | project TimeGenerated, Source = ClientIP, Name = tolower(Name), Process = "", CmdLine = "")
| where Name has_any (known) or Name matches regex lookalike
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Source, Name, Process, CmdLine
```

### Sigma

```yaml
title: TraderTraitor Terraform Registry Typosquat DNS Lookup
id: 5c1e2f10-7a3b-4d5e-9b01-0a5505000001
status: experimental
description: Detects DNS lookups for hashicorp lookalike registries pinned by weaponized .terraform.lock.hcl files in fake job-interview repositories.
references:
  - https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
  - https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1204.002
  - attack.t1566.002
logsource:
  category: dns
detection:
  selection_ioc:
    query|endswith:
      - 'registry.hashicorp-aws.com'
      - 'registry.hashicorp-aws.io'
      - 'registry.hashicorp-terraform.io'
  selection_lookalike:
    query|re: '(^|\.)hashicorp-[a-z0-9-]+\.[a-z0-9.-]+$'
  condition: 1 of selection_*
falsepositives:
  - Internal mirrors or vendor domains that legitimately begin with hashicorp-
  - Security researchers analysing the campaign
level: high

```

**Known false positives:**

- Internal artifact mirrors or vendor domains whose label legitimately starts with hashicorp-
- Security teams investigating the campaign

**Tuning notes:** Replace index and sourcetype with your DNS source (Infoblox, Zeek, Umbrella) keeping a qname field. Allowlist known first-party hashicorp-* domains. Pivot hits to the host's terraform init history and the cloned repository.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TraderTraitor ROOFDECK/FLATROOF Launch With Chromium Renderer Argument From Non-App Path (locked: unlock with TL Creds)
- TraderTraitor FLATROOF Gatekeeper Bypass and Implant Child Process Activity (locked: unlock with TL Creds)
- TraderTraitor ROOFDECK Dead Drop, Nostr and Telegram C2 From Non-App Processes (locked: unlock with TL Creds)
- TraderTraitor Trojanized Terraform Provider terraform-provider-awsbeta Loader Execution (locked: unlock with TL Creds)
- TraderTraitor FLATROOF Keychain, Browser Store and Shell History Harvesting (locked: unlock with TL Creds)
- TraderTraitor FLATROOF/ROOFDECK Implant Files, Config, IPC Pipe and Hashes (locked: unlock with TL Creds)
- TraderTraitor ROOFDECK LaunchAgent Persistence and loginwindow Masquerade (locked: unlock with TL Creds)
- TraderTraitor FLATROOF/ROOFDECK C2 Infrastructure Communication (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `176.97.114[.]232`
- Domain: `technicais[.]sytes[.]net`
- URL: `hxxps://pastebin[.]com/raw/3yptBDhL`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (SentinelOne Labs)](https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/)
- [Jade Sleet's macOS backdoors showed up on an IT-services MacBook (RWP Ventures Intelligence)](https://rwp-ventures.blog/posts/2026-09-21-jade-sleet-it-services-flatroof-roofdeck/)
- [SOC Prime: TraderTraitor Backdoors Target Victims Outside the Cryptocurrency Sector](https://socprime.com/active-threats/tradertraitor-backdoors-target-victims-outside-the-cryptocurrency-sector/)
- [North Korean Hackers Hide Mac Backdoors in Fake Terraform Job Tests (eSecurity Planet)](https://www.esecurityplanet.com/threats/news-north-korean-terraform-malware/)
- [Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors (GBHackers)](https://gbhackers.com/terraform-lock-files/)
- [DPRK backdoors on an Indian IT provider: delivery unproven](https://www.pk-sharma.com/briefing/jade-sleet-indian-it-provider)
- [Trojanized Terraform Provider Campaign: Suspected TraderTraitor Group (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver)
- [The Good, the Bad and the Ugly in Cybersecurity - Week 39 (SentinelOne)](https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-39-8/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5505