Image: images.contentstack.io · rights & removal
Executive Summary
The TraderTraitor group, linked to North Korean state sponsorship, engaged in campaigns targeting cryptocurrency trading entities, culminating in a theft of $292 million from KelpDAO via a compromise of LayerZero Labs. Following this disclosure, SentinelOne identified additional victims infected with macOS backdoors, FLATROOF and ROOFDECK, in an IT services sector organization unaffiliated with cryptocurrency. The initial infection vector involved social engineering through fake job interview lures leading to the installation of weaponized coding projects on developer workstations. These projects contained malicious Terraform lock files that allowed attackers to inject custom provider registries, enabling malware delivery from attacker-controlled sources.
The investigation traced the presence of these backdoors to a DevOps engineer using an Apple Silicon MacBook that held cloud credentials and source control access to AWS and GCP environments. The infection timeline shows the backdoors remained dormant until March 29, when beaconing commenced, after the initial installation of the backdoors via a compromised job lure material. The malware families observed, FLATROOF and ROOFDECK, are ARM64 backdoors written in Rust designed for data collection and command execution on macOS systems.
Facts Only
* TraderTraitor is a DPRK state-sponsored subgroup.
* The initial attack involved compromising LayerZero Labs, resulting in the theft of $292 million from KelpDAO.
* SentinelOne identified additional victims infected with macOS backdoors, FLATROOF and ROOFDECK.
* Victims included an IT services provider in India, utilizing an Apple Silicon MacBook belonging to a DevOps engineer.
* Infection involved social engineering via fake job interview lures leading to weaponized coding projects on workstations.
* Weaponized Terraform lock files allowed malware delivery from custom provider registries controlled by attackers.
* Malware exploits used custom Terraform provider domains: registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, and registry.hashicorp-terraform[.]io.
* The backdoors were installed after an employee ran a weaponized interview coding project on their workstation.
* FLATROOF is the primary backdoor, deploying data collection modules from browser data, terminal history, and system profiles via Telegram exfiltration.
* ROOFDECK is a more sophisticated backdoor that uses Nostr lookups for C2 URL discovery and supports commands for file system manipulation, session control, and reverse shells.
* Indicators of Compromise include specific SHA-1 hashes for the backdoors, C2 domains (e.g., grenight[.]com), IP addresses associated with C2 activity, and specific file paths on the victim machine.
Full Take
The narrative centers on leveraging trusted professional contexts—specifically software development and job seeking—as vectors for deep system compromise. The mechanism hinges on weaponizing developer workflows: by embedding malicious configuration files within standard infrastructure-as-code tools like Terraform, threat actors exploit the inherent trust placed in these tools by developers to execute remote code. This moves the attack surface away from network perimeter defenses and directly into the endpoint development environment, targeting an individual's access to cloud credentials and source code repositories.
The pattern suggests a strategic shift: focusing on low-signal, high-potential targets (developers) who possess wide lateral movement capabilities across cloud infrastructure. The discovery that subsequent infections did not necessarily lead to massive financial gain indicates that the initial compromise was often for establishing persistent, undetectable access rather than immediate monetary exploitation. This challenges the assumption that infiltration of large entities is the primary goal; instead, securing the development pipeline and endpoint monitoring becomes the critical defense layer.
The complexity introduced by the dual-stage malware (FLATROOF for initial data exfiltration and ROOFDECK for sophisticated persistence and C2 management) reflects an escalation in tradecraft by state actors. The use of Nostr networking for C2 redirection suggests an attempt to leverage decentralized or obscure communication channels to bypass traditional network monitoring, a reflection of broader geopolitical patterns where digital operations seek to obscure attribution and movement across jurisdictions. The underlying implication is that the security posture of organizations must account for the risk embedded within human-centric processes, particularly those involving external vetting of code and personnel.
Bridge Questions: If threat actors consistently target endpoints via seemingly innocuous job applications or open-source projects, what systemic changes are required in HR and developer onboarding policies to mitigate this specific social engineering vector? How can organizations effectively measure the security risk associated with developer access to cloud infrastructure against traditional network intrusion metrics? What responsibilities do software platforms like GitHub bear in securing the integrity of code that becomes an attack vehicle?
From the original · SentinelOne Labs
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.Read the full story at sentinelone.com
Sentinel — Human
This text reads like a highly technical threat intelligence report, blending high-level narrative about state actors with extremely granular, machine-readable forensic evidence. Its structure points toward human-led investigation reporting rather than pure generative synthesis.