North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
AI summary · grok-4.7Summaries by Vani AI
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
SentinelLABS reported that North Korean TraderTraitor operators, a Lazarus subgroup also known as UNC4899, PUKCHONG, and Jade Sleet, sent developers fake Terraform hiring tasks in GitHub repositories. Manipulated lock files caused terraform init to fetch malicious providers, which installed the FLATROOF and ROOFDECK macOS backdoors. The tools collected browser data, terminal history, and login keychains, persisted through a LaunchAgent, and supported theft of API keys used against AWS and Google Cloud. Observed victims included LayerZero and an Indian IT provider’s DevOps MacBook, with activity continuing into June.
Key facts
- TraderTraitor is a Lazarus subgroup also tracked as UNC4899, PUKCHONG, and Jade Sleet.
- Fake GitHub Terraform assignments pointed lock files at attacker-controlled providers.
- FLATROOF and ROOFDECK stole macOS data and supported access to AWS and GCP.
- Victims included LayerZero and an Indian IT provider’s DevOps MacBook.
- ROOFDECK used a LaunchAgent and resolved servers through the Nostr network.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1195.001 Compromise Software Dependencies and Development ToolsT1543.001 Launch AgentT1555.001 KeychainT1078.004 Cloud Accounts
- Threat actors
- TraderTraitorLazarus GroupUNC4899Jade SleetPUKCHONG
- Victims
- LayerZero
- Organizations
- SentinelOne
- Countries
- North KoreaIndia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anesthesiaschool.com | .]com Domain associated with the ub certificate user Domain anesthesiaschool[.]com Domain associated with the ub certificate user Domain app |
| domain | cprapid.com | ndpoint, with host resolved at runtime Domain 185-66-91-112.cprapid[.]com Domain associated with the ub certificate user Domain 213 |
| domain | freehealth.lat | m Domain associated with the ub certificate user Domain www.freehealth[.]lat Domain associated with the ub certificate user Domain www |
| domain | galaxy-royal.online | .]com Domain associated with the ub certificate user Domain galaxy-royal[.]online Domain associated with the ub certificate user Domain gam |
| domain | grenight.com | .hubpage[.]cloud ROOFDECK command-and-control server Domain grenight[.]com ROOFDECK command-and-control server IP address 176.97.114 |
| domain | hashicorp-aws.com | the ub certificate user Malicious provider domain registry.hashicorp-aws[.]com Typosquatted Terraform provider domain used in weaponized |
| domain | hashicorp-aws.io | weaponized repositories Malicious provider domain registry.hashicorp-aws[.]io Typosquatted Terraform provider domain used in weaponized |
| domain | hashicorp-terraform.io | weaponized repositories Malicious provider domain registry.hashicorp-terraform[.]io Typosquatted Terraform provider domain used in weaponized |
| domain | heyhay.online | m Domain associated with the ub certificate user Domain app.heyhay[.]online Domain associated with the ub certificate user Domain del |
| domain | hubpage.cloud | es[.]net FLATROOF command-and-control server Domain storage.hubpage[.]cloud ROOFDECK command-and-control server Domain grenight[.]com |
| domain | mactroubleshoots.pro | nline Domain associated with the ub certificate user Domain mactroubleshoots[.]pro Domain associated with the ub certificate user Domain mx0 |
| domain | servehttp.com | Domain associated with the ub certificate user Domain dela.servehttp[.]com Domain associated with the ub certificate user Domain gal |
| domain | sytes.net | ped ROOFDECK, masquerading as loginwindow Domain technicais.sytes[.]net FLATROOF command-and-control server Domain storage.hubpag |
| domain | tinklify.com | nline Domain associated with the ub certificate user Domain tinklify[.]com Domain associated with the ub certificate user Domain upd |
| domain | vaimage.com | nline Domain associated with the ub certificate user Domain vaimage[.]com Domain associated with the ub certificate user Domain wss |
| ipv4 | 176.97.114.232 | enight[.]com ROOFDECK command-and-control server IP address 176.97.114[.]232 FLATROOF C2 associated with technicais.sytes[.]net IP add |
| ipv4 | 45.11.59.140 | ATROOF C2 associated with technicais.sytes[.]net IP address 45.11.59[.]140 ROOFDECK C2 associated with storage.hubpage[.]cloud IP ad |
| ipv4 | 85.137.56.10 | .]245 ROOFDECK C2 associated with grenight[.]com IP address 85.137.56[.]10 ROOFDECK staging server File path ~/Library/com.apple.iTu |
| ipv4 | 85.137.56.245 | FDECK C2 associated with storage.hubpage[.]cloud IP address 85.137.56[.]245 ROOFDECK C2 associated with grenight[.]com IP address 85. |
| md5 | 1cd6d13ff15adbf7a42025d10ec99b4a | rtificate used for TLS communication TLS certificate serial 1cd6d13ff15adbf7a42025d10ec99b4a Custom certificate serial number TLS certificate subject/is |
| sha1 | 02df07a173ab03b82a4fb6a08973fff8b1467f28 | ors of compromise (IoCs):- Type Indicator Description SHA-1 02df07a173ab03b82a4fb6a08973fff8b1467f28 FLATROOF, masquerading as SystemUpdate SHA-1 c491d477dbe0ae |
| sha1 | 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 | ertificate used for TLS communication TLS certificate SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 Custom certificate used for TLS communication TLS certifica |
| sha1 | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | ed9dbe237144c03f73ec4 ROOFDECK, masquerading as iSync SHA-1 5728b11d30586bbfc1d8bd12df1c722a06e767a2 Stripped ROOFDECK, masquerading as loginwindow Domain techn |
| sha1 | c491d477dbe0ae04e9aed9dbe237144c03f73ec4 | 73fff8b1467f28 FLATROOF, masquerading as SystemUpdate SHA-1 c491d477dbe0ae04e9aed9dbe237144c03f73ec4 ROOFDECK, masquerading as iSync SHA-1 5728b11d30586bbfc1d8b |
| sha256 | 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa | loudshield Malicious workspace path TLS certificate SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa Custom certificate used for TLS communication TLS certifica |
From the original article
5 min read at cybersecuritynews.com
North Korean threat actors are using fake Terraform job tests to compromise macOS developers and reach cloud systems. The campaign shows how a routine coding assignment can become an entry point for data theft, remote control, and deeper network intrusion. The activity is tied to TraderTraitor, a financially motivated Lazarus subgroup also tracked as UNC4899, […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.