Threat video1:00
TraderTraitor macOS FLATROOF Backdoor: Detection & IOCs
Fake Terraform job tests drop FLATROOF and ROOFDECK on a DevOps Mac with no crypto ties. Includes 9 detection rules, 29 IOCs and a free Splunk SPL query.
Read the full threat intel for TraderTraitor macOS FLATROOF Backdoor: Detection & IOCs →
Chapters
- 0:00The hookBackdoors target IT services now too.
- 0:04The storyMac harbored backdoors for 11 days.
- 0:11Attack pathFake interviews exploited typosquatted providers.
- 0:24AttributionAttributed to TraderTraitor.
- 0:28Indicators of compromise29 indicators to hunt: 3 IPs, 10 domains and 1 URL, and more.
- 0:36MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to command and control.
- 0:41Remediation4 steps now: Hunt macOS endpoints for the FLATROOF/ROOFDECK file paths, SHA-1 hashes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Backdoors target IT services now too.
0:05Mac harbored backdoors for 11 days.
0:07Cursor IDE triggered beaconing.
0:11Fake interviews exploited typosquatted providers.
0:14Cursor IDE launched two Rust backdoors.
0:17They harvested credentials and beaconed to Telegram.
0:24Attributed to TraderTraitor. Confidence: high.
0:2929 indicators to hunt: 3 IPs, 10 domains and 1 URL, and more.
0:3618 ATT&CK techniques, from initial access to command and control.
0:424 steps now: Hunt macOS endpoints for the FLATROOF/ROOFDECK file paths, SHA-1 hashes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.