North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
78
Victim
LayerZero
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 18, 2026
- Last mentionedSep 21, 2026
Timeline
3 articles · newest firstHackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
80
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
68
Appears with
- PUKCHONGthreat actor · 3
- Jade Sleetthreat actor · 3
- ROOFDECKmalware · 3
- UNC4899threat actor · 3
- Terraformproduct · 3
- FLATROOFmalware · 3
- TraderTraitorthreat actor · 3
- Lazarus Groupthreat actor · 2
- KelpDAOvictim · 2
- SentinelOnevendor · 2
- HashiCorpvendor · 2
- GitHubvendor · 2
- macOSproduct · 1
- SentinelOneorganization · 1
- Lazarusthreat actor · 1
- Cursorvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.