Cybersecurity researchers have identified a new victim of the TraderTraitor threat group, a financially motivated subgroup of the North Korean state-sponsored Lazarus APT. The attack, which utilized macOS backdoors previously seen in a high-profile compromise of LayerZero, targeted an IT services provider in India with no ties to cryptocurrency, indicating an expansion of the group's targeting beyond the crypto sector.
The newly identified victim, a smaller organization, was infected with the FLATROOF (also known as macOS.Gaslight) and ROOFDECK macOS backdoors. These backdoors were first observed in April 2026 during the attack on LayerZero, a cross-blockchain cryptocurrency exchange service, which resulted in a reported loss of USD 292 million from KelpDAO.
TraderTraitor, also tracked as UNC4899, PUKCHONG, and Jade Sleet, typically employs social engineering tactics, specifically fake job interview lures, to compromise targets. These campaigns often involve weaponized GitHub repositories designed as infrastructure engineering projects, tailored to the target company. The attackers contact job seekers whose GitHub profiles indicate expertise in DevOps or FinTech engineering.
In these schemes, the GitHub repositories contain a weaponized `.terraform.lock.hcl` file. This file includes a custom Terraform provider that points to attacker-controlled domains, such as `registry.hashicorp-aws[.]com`, `registry.hashicorp-aws[.]io`, and `registry.hashicorp-terraform[.]io`. When a victim executes `terraform init` with this malicious lockfile, Terraform is tricked into downloading and running the attacker's custom provider modules. Researchers identified additional lure repositories by pivoting from the `gtn-candidate-repo` shared by LayerZero, including `Northwind-IAC`, `novacart-interview`, and `terraform-candidate-repo`.
While the exact delivery method for the backdoors on the new victim's system could not be definitively proven, telemetry data showed FLATROOF and ROOFDECK present on an Apple Silicon MacBook belonging to a DevOps engineer as early as March 18, 2026. The engineer regularly used Terraform and Ansible against AWS, OVH, and OpenStack, and their machine held critical cloud credentials and source control access.
The implants remained dormant until March 29, 2026, when beaconing and host activity began. On that day, the engineer opened a workspace named `~/DevOps-Automation/cloudshield` in the Cursor integrated development environment. Seconds later, Cursor launched both implants: `nohup /SystemUpdate type=renderer` and `nohup /iSync type=renderer`. These implants then established command-and-control (C2) connections to `technicais` (176[.]97.114.232) and `hubpage` (45[.]11.59.140), respectively. The implants also re-armed themselves by bypassing Gatekeeper, stripping the `com.apple.quarantine` extended attribute and setting execute permissions.
Beaconing continued steadily until April 19, gated by Cursor sessions, meaning the backdoors were active only when Cursor was running. On April 13, the developer cloned `terraform-candidate-repo` via GitHub Desktop, and on April 14, FLATROOF re-armed ROOFDECK again. On April 20, the day after LayerZero's public disclosure, ROOFDECK staged a third-stage payload named `loginwindow` from 85[.]137.56.10, which then connected to `grenight[.]com` (85[.]137.56.245). Later that day, `loginwindow` deleted the original FLATROOF and ROOFDECK implants. The third-stage implant continued beaconing to `grenight[.]com` until the last observed C2 activity on June 1, 2026.
The compromise of this IT services provider highlights that TraderTraitor's targeting extends beyond organizations directly involved in cryptocurrency. The value of such targets lies in the access their systems provide to cloud environments and other critical infrastructure, making DevOps engineers and individuals with extensive cloud credentials prime targets for these financially motivated attacks.
