Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

* TraderTraitor, a DPRK state-sponsored group, attacked KelpDAO through a compromise of LayerZero Labs in April 2026, resulting in the theft of USD 292 million.
* SentinelOne identified additional victims infected with macOS backdoors FLATROOF and ROOFDECK following the LayerZero Labs attack.
* The attack leveraged social engineering via fake job interviews targeting developers in DevOps or FinTech roles.
* Weaponized Terraform lock files, specifically `.terraform.lock.hcl`, contained references to custom provider domains (registry.hashicorp-aws[.]com, etc.).
* Running `terraform init` with these lockfiles resulted in the execution of malicious provider modules.
* The macOS backdoors FLATROOF and ROOFDECK were installed after an employee used a weaponized coding project on a workstation.
* The malware utilized data harvesting methods, including collecting browser data, command histories, and system profiles.
* FLATROOF was deployed under the name SystemUpdate to `~/Library/com.apple.iTunesCloud/SystemUpdate`.
* ROOFDECK used configuration files, such as `~/.config/.replhistory`, to manage C2 URLs and beaconing intervals.
* The execution timeline showed backdoors present from March 18, with initial execution observed on March 29.

The narrative demonstrates a shift in threat actor focus from directly targeting large DeFi protocols to exploiting the software supply chain and the developer endpoint as a persistent access vector. The use of weaponized Terraform files is a critical bridge: it transforms a standard development workflow into an attack mechanism, making the source code itself the delivery vehicle for persistence. The infiltration path moves from a high-value financial target (KelpDAO) to lower-value IT services providers, suggesting a broader strategy where exploiting developer trust provides access to more disparate entities.
The macOS malware, FLATROOF and ROOFDECK, exhibit sophisticated capabilities aligned with known state-sponsored toolsets, particularly in session control (`session`, `tasks`, `rssh`) and post-exploitation reconnaissance (file system manipulation via `find`, exfiltration via `upload`). The use of a self-signed certificate signed by `mkcert` on the implant further indicates an attempt to maintain operational security while establishing C2 channels. This suggests an operational maturity where operators can deploy customized tools that mimic legitimate development artifacts, layered over the established infrastructure of the initial breach.
The pattern suggests that focusing on securing the software supply chain—specifically dependency management and developer endpoints—is paramount because it is the weakest link in multi-cloud environments. The successful manipulation of developers relies not just on technical vulnerabilities but on exploiting human processes (job seeking) and workflow expectations. The implication for cognitive sovereignty is recognizing that infrastructure security must account for the entire lifecycle of code, from repository creation to endpoint execution.
Bridge Questions:
What other avenues exist besides social engineering job lures that actors use to establish initial access in the developer ecosystem?
How can organizations design mandatory security gates around dependency resolution (like Terraform providers) that are enforced regardless of developer intent?
If persistence is achieved through code artifacts and ephemeral backdoors, what continuous monitoring mechanisms best detect anomalies in developer-centric file system or process behavior rather than just network traffic?