ROOFDECK (Malware): news timeline & CVEs

North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors

North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.

SentinelLABS reported that North Korean TraderTraitor operators, a Lazarus subgroup also known as UNC4899, PUKCHONG, and Jade Sleet, sent developers fake Terraform hiring tasks in GitHub repositories. Manipulated lock files caused terraform init to fetch malicious providers, which installed the FLATROOF and ROOFDECK macOS backdoors. The tools collected browser data, terminal history, and login keychains, persisted through a LaunchAgent, and supported theft of API keys used against AWS and Google Cloud. Observed victims included LayerZero and an Indian IT provider’s DevOps MacBook, with activity continuing into June.

Cyber Security NewsSep 21, 12:18 UTC · 5d agoThreat actor in the wild 3 sources

Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors

North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.

SentinelOne reports that TraderTraitor (UNC4899, Jade Sleet, PUKCHONG), a DPRK-aligned Lazarus subgroup, expanded its Contagious Interview-style developer targeting beyond cryptocurrency victims, weaponizing .terraform.lock.hcl files to redirect terraform init to typosquatted registries such as registry.hashicorp-aws[.]com and registry.hashicorp-terraform[.]io. An India-based IT services provider was infected with FLATROOF (macOS.Gaslight) and ROOFDECK implants observed on disk from March 18, 2026, on an Apple Silicon MacBook administered by a DevOps engineer managing AWS, OVH and OpenStack infrastructure. FLATROOF persists via a LaunchAgents plist, removes the quarantine attribute to bypass Gatekeeper, and collects keychain, browser, and command history data, exfiltrating via Telegram, while ROOFDECK resolves C2 through Nostr relays as a dead-drop mechanism. The same implants were tied to the April 2026 KelpDAO rsETH bridge attack via LayerZero, in which 116,500 rsETH (~$292 million) was stolen, with attribution by LayerZero, Mandiant, and CrowdStrike.

GBHackersupdated Sep 21, 12:18 UTC · 5d agofirst Sep 21, 08:53 UTC · 6d agoThreat actor in the wild

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.

SentinelOne attributed the compromise of a smaller India-based IT services provider to North Korean actor Jade Sleet, also known as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The campaign used job-interview GitHub lures and weaponized Terraform lockfiles to deliver the macOS backdoors FLATROOF, also called Gaslight, and ROOFDECK. FLATROOF uses Telegram for command-and-control and can steal browser, terminal, and keychain data; ROOFDECK uses Nostr and Launch Agents. The implants were present by March 18, 2026, and the same tooling was previously tied to the KelpDAO LayerZero incident.

The Hacker Newsupdated Sep 21, 12:18 UTC · 5d agofirst Sep 21, 06:06 UTC · 6d agoThreat actor in the wild 3 sources

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.

Following the April 2026 disclosure of the TraderTraitor attack on LayerZero that stole $292 million from KelpDAO via a fake crypto minting event and DDoS, SentinelOne identified a second victim: an India-based IT services provider with no cryptocurrency ties. FLATROOF (macOS.Gaslight) and ROOFDECK backdoors were found on a DevOps engineer's Apple Silicon MacBook, dormant from March 18 before beaconing on March 29. Campaigns use fake job interview lures with weaponized GitHub repositories whose .terraform.lock.hcl files pull malicious providers from typosquatted domains like registry.hashicorp-aws[.]com during terraform init. The backdoors collected API keys and escalated privileges into the victim's AWS and GCP environments.

SentinelLABSSep 18, 17:00 UTC · 8d agoThreat actor in the wild

ROOFDECK

Timeline4 articles

Appears with

North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors

Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties