Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
SentinelOne reports that TraderTraitor (UNC4899, Jade Sleet, PUKCHONG), a DPRK-aligned Lazarus subgroup, expanded its Contagious Interview-style developer targeting beyond cryptocurrency victims, weaponizing .terraform.lock.hcl files to redirect terraform init to typosquatted registries such as registry.hashicorp-aws[.]com and registry.hashicorp-terraform[.]io. An India-based IT services provider was infected with FLATROOF (macOS.Gaslight) and ROOFDECK implants observed on disk from March 18, 2026, on an Apple Silicon MacBook administered by a DevOps engineer managing AWS, OVH and OpenStack infrastructure. FLATROOF persists via a LaunchAgents plist, removes the quarantine attribute to bypass Gatekeeper, and collects keychain, browser, and command history data, exfiltrating via Telegram, while ROOFDECK resolves C2 through Nostr relays as a dead-drop mechanism. The same implants were tied to the April 2026 KelpDAO rsETH bridge attack via LayerZero, in which 116,500 rsETH (~$292 million) was stolen, with attribution by LayerZero, Mandiant, and CrowdStrike.
- Weaponized .terraform.lock.hcl files redirect terraform init to typosquatted registries delivering attacker-controlled provider code.
- FLATROOF achieves LaunchAgent persistence, bypasses Gatekeeper via quarantine removal, and exfiltrates data through Telegram.
- ROOFDECK uses Nostr profiles and relays as a dead-drop resolver to hide command-and-control infrastructure.
- Implants activated only during active Cursor sessions, quieting when the development environment was closed to evade detection.
- Same implants were used in the April 2026 KelpDAO-LayerZero incident involving theft of 116,500 rsETH worth ~$292M.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1195.001 Compromise Software Dependencies and Development ToolsT1543.001 Launch AgentT1553.001 Gatekeeper BypassT1102 Dead Drop Resolver
- Products
- Terraform
- Threat actors
- TraderTraitorUNC4899Jade SleetPUKCHONGLazarus Group
- Organizations
- MandiantCrowdStrike
- Countries
- North Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | grenight.com | CK binaries. The newer payload continued communicating with grenight[.]com until June 1. The same malware families were previously d |
| domain | hashicorp-aws.com | n typosquatted attacker infrastructure, including: registry.hashicorp-aws[.]com , registry.hashicorp-aws[.]io , and registry.hashicorp-te |
| domain | hashicorp-aws.io | ructure, including: registry.hashicorp-aws[.]com , registry.hashicorp-aws[.]io , and registry.hashicorp-terraform[.]io . When a victim e |
| domain | hashicorp-terraform.io | corp-aws[.]com , registry.hashicorp-aws[.]io , and registry.hashicorp-terraform[.]io . When a victim executes terraform init , Terraform uses |
| domain | hubpage.cloud | w) Domain technicais.sytes[.]net FLATROOF C2 Domain storage.hubpage[.]cloud ROOFDECK C2 Domain grenight[.]com ROOFDECK C2 IP 176.97.1 |
| domain | sytes.net | a06e767a2 Stripped ROOFDECK (loginwindow) Domain technicais.sytes[.]net FLATROOF C2 Domain storage.hubpage[.]cloud ROOFDECK C2 Do |
| ipv4 | 176.97.114.232 | ge[.]cloud ROOFDECK C2 Domain grenight[.]com ROOFDECK C2 IP 176.97.114[.]232 FLATROOF C2 (technicais.sytes[.]net) Note: IP addresses a |
| sha1 | 02df07a173ab03b82a4fb6a08973fff8b1467f28 | Terraform provider downloads. IOCs Type IOC What it is SHA1 02df07a173ab03b82a4fb6a08973fff8b1467f28 FLATROOF (SystemUpdate) SHA1 c491d477dbe0ae04e9aed9dbe23714 |
| sha1 | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | 1d477dbe0ae04e9aed9dbe237144c03f73ec4 ROOFDECK (iSync) SHA1 5728b11d30586bbfc1d8bd12df1c722a06e767a2 Stripped ROOFDECK (loginwindow) Domain technicais.sytes[.]n |
| sha1 | c491d477dbe0ae04e9aed9dbe237144c03f73ec4 | ab03b82a4fb6a08973fff8b1467f28 FLATROOF (SystemUpdate) SHA1 c491d477dbe0ae04e9aed9dbe237144c03f73ec4 ROOFDECK (iSync) SHA1 5728b11d30586bbfc1d8bd12df1c722a06e76 |
From the original article
4 min read at gbhackers.com
North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.