8 minhigh
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor deploys macOS backdoors FLATROOF and ROOFDECK via weaponized Terraform lockfiles in fake job interview lures, expanding targeting beyond cryptocurrency to IT services and DevOps engineers. FLATROOF and ROOFDECK are ARM64 Rust backdoors for macOS. FLATROOF harvests browser data, keychains, and terminal history via Telegram. ROOFDECK uses Nostr dead-drop resolution for C2, supports file operations, reverse shells, and clipboard manipulation. Both masquerade as system processes using --type=renderer. A stage-3 update replaced implants with a stripped loginwindow binary, persisting beaconing for over two months.
Sens:▲ 24h
IOCs47
26domain7file path5url4ip4sha11sha256
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block known C2 IPs and domains at network egress points.
- Hunt for FLATROOF and ROOFDECK hashes across macOS endpoints.
- If EDR supports host isolation, isolate affected macOS endpoints.
- Revoke cloud credentials from compromised developer machines.
Key Takeaways
- FLATROOF and ROOFDECK are ARM64 Rust backdoors targeting macOS Apple Silicon.
- Weaponized .terraform.lock.hcl files redirect provider downloads to attacker-controlled registry domains.
- ROOFDECK resolves C2 via Nostr relays by reading operator profile website fields.
- Implants beacon only while Cursor IDE is running, remaining dormant otherwise.
- Malware developer's mkcert certificate exposes QEMU VM environment with username 'ub'.
Attack Chain
- Initial Access: Fake job interview lures deliver weaponized GitHub repos with malicious Terraform lockfiles
- Execution: terraform init downloads and executes malicious provider from attacker-controlled registry domain
- Persistence: LaunchAgents plist installed with --type=renderer masquerade and RunAtLoad=true
- C2: FLATROOF beacons via Telegram; ROOFDECK resolves C2 via Nostr then HTTPS with pinned TLS
- Collection: Browser data, keychain, terminal history, and process snapshots exfiltrated
- Defense Evasion: Stage-3 loginwindow replaces implants; originals deleted via rm -f
Affected Systems
- macOS (Apple Silicon / ARM64)
- Terraform users running lockfiles from untrusted sources
- DevOps engineers with cloud and source control access
- Cursor IDE users on macOS
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Unsigned binaries from home directory and IDE child processes are observable but macOS EDR coverage varies. |
| Network Visibility | Medium | Pinned TLS prevents payload inspection; Nostr and Telegram traffic patterns are observable. |
| Detection Difficulty | Hard | Rust binaries, system process masquerading, IDE-gated beaconing, and encrypted C2 complicate detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unsigned ARM64 binaries executing from ~/Library/com.apple.* paths masquerading as Apple system processes (T1036.005) | Process creation, code signature status | Defense Evasion | Low — Apple system binaries do not run from user Library paths |
| IDE processes spawning child processes with --type=renderer argument outside expected browser context (T1059) | Process ancestry and command line | Execution | Medium — Electron apps may spawn renderer processes |
| Terraform init downloading providers from non-official registry domains (T1105) | DNS queries, HTTP connections from terraform | Execution | Low — official registry is registry.terraform.io only |
| Processes removing com.apple.quarantine extended attributes from binaries in user library paths (T1553.001) | Endpoint file attribute changes | Defense Evasion | Low — xattr removal from Library paths is atypical |
Required Log Sources
- macOS Unified Log
- Process creation events
- Network connection logs
- File system events
- LaunchAgents modifications
- TLS connection metadata
Key Behavioral Indicators
- Unsigned ARM64 binaries in ~/Library/com.apple.* paths
- LaunchAgents plists with --type=renderer and RunAtLoad=true
- Cursor IDE spawning nohup processes with renderer flag
- Config file at ~/.config/.repl_history with Nostr keys
- Named pipe /private/tmp/.pipe-airway for IPC
- Terraform lockfiles referencing non-official provider domains
Control Gaps
- Gatekeeper bypass via xattr removal not blocked on developer endpoints
- Pinned TLS prevents network inspection of C2 traffic
- Nostr relay traffic appears as legitimate websocket connections
- IDE-gated beaconing evades time-based detection windows
- Terraform provider registry validation absent
False Positive Assessment
Low — Apple system process names in non-standard ~/Library paths with --type=renderer flag and unsigned binaries are highly suspicious on macOS.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict Terraform provider downloads to official registry.terraform.io domain.
- Block outbound connections to known malicious provider registry domains.
- Monitor and alert on Nostr relay websocket connections from developer endpoints.
- Implement TLS inspection for developer endpoint egress traffic.
User Protection
- Flag developers with cloud and source control access as high-risk monitoring group.
- Deploy EDR with macOS ARM64 support on all developer endpoints.
- Alert on unsigned binaries executing from user home directory paths.
- Block GitHub repository clones containing weaponized Terraform lockfiles.
Security Awareness
- Train developers on risks of running unfamiliar Terraform projects with lockfiles.
- Educate staff that DPRK actors target developers via fake job interviews.
- Prohibit using corporate workstations for external job interview coding exercises.
- Teach developers to verify Terraform provider domains before running terraform init.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping25 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
North Korean hackers posing as recruiters send fake job interview coding projects to software developers. The projects contain hidden malware in Terraform configuration files that, when run, install backdoors on macOS computers. The backdoors steal browser data, passwords, and cloud credentials. An IT services company in India was targeted even though it had no cryptocurrency ties. Developers should verify Terraform provider domains before running unfamiliar projects and organizations should monitor developer endpoints for suspicious activity.
Additional IOCs
- Domains:
registry[.]hashicorp-aws[.]com- Malicious Terraform provider registry domainregistry[.]hashicorp-aws[.]io- Malicious Terraform provider registry domainregistry[.]hashicorp-terraform[.]io- Malicious Terraform provider registry domain185-66-91-112[.]cprapid[.]com- Domain using attacker mkcert certificate213-111-146-132[.]cprapid[.]com- Domain using attacker mkcert certificateanesthesiaschool[.]com- Domain using attacker mkcert certificateapp[.]heyhay[.]online- Domain using attacker mkcert certificatedela[.]servehttp[.]com- Domain using attacker mkcert certificategalaxy-royal[.]online- Domain using attacker mkcert certificategame[.]galaxy-royal[.]online- Domain using attacker mkcert certificateheyhay[.]online- Domain using attacker mkcert certificatemactroubleshoots[.]pro- Domain using attacker mkcert certificatemx01[.]galaxy-royal[.]online- Domain using attacker mkcert certificatens4[.]galaxy-royal[.]online- Domain using attacker mkcert certificatetinklify[.]com- Domain using attacker mkcert certificateupdate[.]heyhay[.]online- Domain using attacker mkcert certificatevaimage[.]com- Domain using attacker mkcert certificatewss[.]sytes[.]net- Domain using attacker mkcert certificatewww[.]anesthesiaschool[.]com- Domain using attacker mkcert certificatewww[.]freehealth[.]lat- Domain using attacker mkcert certificatewww[.]heyhay[.]online- Domain using attacker mkcert certificatewww[.]mactroubleshoots[.]pro- Domain using attacker mkcert certificatewww[.]tinklify[.]com- Domain using attacker mkcert certificate
- Urls:
hxxps://github[.]com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl- Weaponized Terraform lockfile repositoryhxxps://github[.]com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl- Weaponized Terraform lockfile repositoryhxxps://github[.]com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl- Weaponized Terraform lockfile repositoryhxxps://github[.]com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md- README referencing weaponized provider domainhxxps://github[.]com/Steed-LHV/assessment- Repository referencing weaponized provider domain
- File Hashes:
4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa(SHA256) - Attacker mkcert TLS certificate fingerprint4ad92bf92ee614b05c340ce17bef7b6ef5a25e82(SHA1) - Attacker mkcert TLS certificate fingerprint
- File Paths:
~/Library/com.apple.iTunesCloud/SystemUpdate- FLATROOF binary drop path~/Library/com.apple.internal.ck/iSync- ROOFDECK binary drop path~/Library/com.apple.appleaccountd/loginwindow- Stripped ROOFDECK stage 3 path~/Library/LaunchAgents/loginwindow.plist- ROOFDECK persistence plist$HOME/.config/.repl_history- ROOFDECK C2 config file/private/tmp/.pipe-airway- ROOFDECK IPC named pipe$TMPDIR/tmp*.lock- FLATROOF lock file
- Command Lines:
- Purpose: Remove Gatekeeper quarantine attribute from implant | Tools:
xattr| Stage: Defense Evasion |xattr -rd com.apple.quarantine <path> - Purpose: Make implant binary executable after quarantine removal | Tools:
chmod| Stage: Defense Evasion |chmod +x <path> - Purpose: Launch implant masquerading as renderer process | Tools:
nohup| Stage: Execution |nohup <path> --type=renderer - Purpose: Delete original implants after stage 3 deployment | Tools:
rm| Stage: Defense Evasion |rm -f <path>
- Purpose: Remove Gatekeeper quarantine attribute from implant | Tools:
- Other:
1cd6d13ff15adbf7a42025d10ec99b4a- Attacker mkcert TLS certificate serial numberO=mkcert development CA, OU=ub@ub-Standard-PC-Q35-ICH9-2009, CN=mkcert ub@ub-Standard-PC-Q35-ICH9-2009- Attacker mkcert certificate subject/issuer revealing QEMU VM
Showing defanged values
- domain185-66-91-112[.]cprapid[.]comDomain using attacker mkcert certificate
- domain213-111-146-132[.]cprapid[.]comDomain using attacker mkcert certificate
- domainanesthesiaschool[.]comDomain using attacker mkcert certificate
- domainapp[.]heyhay[.]onlineDomain using attacker mkcert certificate
- domaindela[.]servehttp[.]comDomain using attacker mkcert certificate
- domaingalaxy-royal[.]onlineDomain using attacker mkcert certificate
- domaingame[.]galaxy-royal[.]onlineDomain using attacker mkcert certificate
- domaingrenight[.]comROOFDECK stage 3 C2 domain
- domainheyhay[.]onlineDomain using attacker mkcert certificate
- domainmactroubleshoots[.]proDomain using attacker mkcert certificate
- domainmx01[.]galaxy-royal[.]onlineDomain using attacker mkcert certificate
- domainns4[.]galaxy-royal[.]onlineDomain using attacker mkcert certificate
- domainregistry[.]hashicorp-aws[.]comMalicious Terraform provider registry domain
- domainregistry[.]hashicorp-aws[.]ioMalicious Terraform provider registry domain
- domainregistry[.]hashicorp-terraform[.]ioMalicious Terraform provider registry domain
- domainstorage[.]hubpage[.]cloudROOFDECK C2 domain
- domaintechnicais[.]sytes[.]netFLATROOF C2 domain
- domaintinklify[.]comDomain using attacker mkcert certificate
- domainupdate[.]heyhay[.]onlineDomain using attacker mkcert certificate
- domainvaimage[.]comDomain using attacker mkcert certificate
- domainwss[.]sytes[.]netDomain using attacker mkcert certificate
- domainwww[.]anesthesiaschool[.]comDomain using attacker mkcert certificate
- domainwww[.]freehealth[.]latDomain using attacker mkcert certificate
- domainwww[.]heyhay[.]onlineDomain using attacker mkcert certificate
- domainwww[.]mactroubleshoots[.]proDomain using attacker mkcert certificate
- domainwww[.]tinklify[.]comDomain using attacker mkcert certificate
- file_path$HOME/.config/.repl_historyROOFDECK C2 config file
- file_path$TMPDIR/tmp*.lockFLATROOF lock file
- file_path~/Library/com.apple.appleaccountd/loginwindowStripped ROOFDECK stage 3 path
- file_path~/Library/com.apple.internal.ck/iSyncROOFDECK binary drop path
- file_path~/Library/com.apple.iTunesCloud/SystemUpdateFLATROOF binary drop path
- file_path~/Library/LaunchAgents/loginwindow.plistROOFDECK persistence plist
- file_path/private/tmp/.pipe-airwayROOFDECK IPC named pipe
- ip176[.]97[.]114[.]232FLATROOF C2 server IP
- ip45[.]11[.]59[.]140ROOFDECK C2 server IP
- ip85[.]137[.]56[.]10ROOFDECK staging server IP
- ip85[.]137[.]56[.]245ROOFDECK stage 3 C2 server IP
- sha102df07a173ab03b82a4fb6a08973fff8b1467f28FLATROOF (SystemUpdate) binary hash
- sha14ad92bf92ee614b05c340ce17bef7b6ef5a25e82Attacker mkcert TLS certificate fingerprint
- sha15728b11d30586bbfc1d8bd12df1c722a06e767a2Stripped ROOFDECK (loginwindow) binary hash
- sha1c491d477dbe0ae04e9aed9dbe237144c03f73ec4ROOFDECK (iSync) binary hash
- sha2564b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daaAttacker mkcert TLS certificate fingerprint
- urlhxxps://github[.]com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/[.]terraform[.]lock[.]hclWeaponized Terraform lockfile repository
- urlhxxps://github[.]com/exubient0/terraform-candidate-repo/blob/main/[.]terraform[.]lock[.]hclWeaponized Terraform lockfile repository
- urlhxxps://github[.]com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/[.]terraform[.]lock[.]hclWeaponized Terraform lockfile repository
- urlhxxps://github[.]com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README[.]mdREADME referencing weaponized provider domain
- urlhxxps://github[.]com/Steed-LHV/assessmentRepository referencing weaponized provider domain