Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
Following the April 2026 disclosure of the TraderTraitor attack on LayerZero that stole $292 million from KelpDAO via a fake crypto minting event and DDoS, SentinelOne identified a second victim: an India-based IT services provider with no cryptocurrency ties. FLATROOF (macOS.Gaslight) and ROOFDECK backdoors were found on a DevOps engineer's Apple Silicon MacBook, dormant from March 18 before beaconing on March 29. Campaigns use fake job interview lures with weaponized GitHub repositories whose .terraform.lock.hcl files pull malicious providers from typosquatted domains like registry.hashicorp-aws[.]com during terraform init. The backdoors collected API keys and escalated privileges into the victim's AWS and GCP environments.
- New victim is an India-based IT services provider with no cryptocurrency ties.
- FLATROOF (macOS.Gaslight) and ROOFDECK backdoors found on a DevOps engineer's MacBook.
- Weaponized .terraform.lock.hcl files pull providers from typosquatted registry domains on terraform init.
- LayerZero compromise enabled a fake mint event plus DDoS, stealing $292 million from KelpDAO.
- Backdoors harvest API keys and expand into victim AWS and GCP environments.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1195.001 Compromise Software Dependencies and Development ToolsT1204.002 User Execution: Malicious FileT1528 Steal Application Access TokenT1078.004 Cloud Accounts
- Threat actors
- TraderTraitorLazarusUNC4899PUKCHONGJade Sleet
- Countries
- North KoreaIndia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | damus.io | str relays used for operator profile discovery: wss://relay.damus[.]io wss://nos[.]lol wss://nostr[.]mom wss://relay.snort[.]soc |
| domain | grenight.com | -04-20 08:49:38 Stage 3 C2 connection loginwindow online => grenight[.]com (85[.]137.56.245) 2026-04-20 13:15:11 Anti-forensics logi |
| domain | hashicorp-aws.com | ous provider domains across multiple repositories: registry.hashicorp-aws[.]com registry.hashicorp-aws[.]io registry.hashicorp-terraform[ |
| domain | hashicorp-aws.io | ultiple repositories: registry.hashicorp-aws[.]com registry.hashicorp-aws[.]io registry.hashicorp-terraform[.]io When the victim runs te |
| domain | hashicorp-terraform.io | ry.hashicorp-aws[.]com registry.hashicorp-aws[.]io registry.hashicorp-terraform[.]io When the victim runs terraform init with the weaponized l |
| domain | nos.lol | or operator profile discovery: wss://relay.damus[.]io wss://nos[.]lol wss://nostr[.]mom wss://relay.snort[.]social wss://offcha |
| domain | nostr.band | wss://relay.snort[.]social wss://offchain[.]pub wss://relay.nostr[.]band wss://nostr.oxtr[.]dev wss://nostr[.]wine Persistence was |
| domain | nostr.mom | ile discovery: wss://relay.damus[.]io wss://nos[.]lol wss://nostr[.]mom wss://relay.snort[.]social wss://offchain[.]pub wss://rel |
| domain | nostr.watch | l Upon first execution, it pulls live Nostr relays from api.nostr[.]watch/v1/online and combines them with a hardcoded relay list b |
| domain | nostr.wine | .]pub wss://relay.nostr[.]band wss://nostr.oxtr[.]dev wss://nostr[.]wine Persistence was achieved via a plist entry ~/Library/Laun |
| domain | offchain.pub | os[.]lol wss://nostr[.]mom wss://relay.snort[.]social wss://offchain[.]pub wss://relay.nostr[.]band wss://nostr.oxtr[.]dev wss://nos |
| domain | oxtr.dev | l wss://offchain[.]pub wss://relay.nostr[.]band wss://nostr.oxtr[.]dev wss://nostr[.]wine Persistence was achieved via a plist e |
| domain | snort.social | ay.damus[.]io wss://nos[.]lol wss://nostr[.]mom wss://relay.snort[.]social wss://offchain[.]pub wss://relay.nostr[.]band wss://nostr |
| ipv4 | 176.97.114.232 | 26-03-29 05:00:55 C2 connection SystemUpdate => technicais (176[.]97.114.232), iSync => hubpage (45[.]11.59.140), Telegram at 05:00:58 |
| ipv4 | 45.11.59.140 | mUpdate => technicais (176[.]97.114.232), iSync => hubpage (45[.]11.59.140), Telegram at 05:00:58 2026-03-29 05:00:58 Implant re-arm |
| ipv4 | 85.137.56.10 | x) 2026-04-20 08:48:59 Stage 3 staging ROOFDECK stages from 85[.]137.56.10, retrieves 3rd-stage loginwindow (one day after LayerZero |
| ipv4 | 85.137.56.245 | Stage 3 C2 connection loginwindow online => grenight[.]com (85[.]137.56.245) 2026-04-20 13:15:11 Anti-forensics loginwindow deletes b |
| md5 | 1cd6d13ff15adbf7a42025d10ec99b4a | H9-2009 CN = mkcert ub@ub-Standard-PC-Q35-ICH9-2009 Serial: 1CD6D13FF15ADBF7A42025D10EC99B4A Key: RSA 3072-bit Validity: 2025-06-20 11:06:53 UTC -> 2035 |
| sha1 | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | new version of ROOFDECK to the compromised machine (SHA-1: 5728b11d30586bbfc1d8bd12df1c722a06e767a2 , path ~/Library/com.apple.appleaccountd/loginwindow ) as a |
From the original article
12 min read at sentinelone.com
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
By Albert Priego, Alex Delamotte & Matej Havranek · sentinelone.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.