Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A trojanized Terraform AWS provider installs FLATROOF and ROOFDECK malware on developer macOS, Linux, and Windows systems.
76
Product
Terraform
- Mentions · 7d0
- Mentions · 30d3
- All mentions12
- First seenSep 4, 2026
- Last mentioned23d ago
Timeline
12 articles · newest firstSuspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.
76
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Suspected TraderTraitor operators trojanized a Terraform provider to deliver the cross-platform FLATROOF backdoor.
72
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT
Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.
75
The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
75
North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
78
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
80
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
76
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
68
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.
65
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
66
Related CVEs
by mentions- CVE-2026-393642%8.2Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200…
Appears with
- ROOFDECKmalware · 7
- HashiCorpvendor · 7
- TraderTraitorthreat actor · 7
- FLATROOFmalware · 7
- Jade Sleetthreat actor · 6
- UNC4899threat actor · 4
- KelpDAOvictim · 3
- LayerZerovictim · 3
- Applevendor · 3
- SentinelOneorganization · 3
- Aikidoorganization · 3
- Graphalgomalware · 3
- PUKCHONGthreat actor · 3
- macOSproduct · 2
- GitHubvendor · 2
- Lazarus Groupthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.