TraderTraitor Uses Malicious Terraform Project to Compromise Indian IT Services Company

AT A GLANCE

SlowMist said that the North Korea-linked group TraderTraitor used fake recruitment and malicious Terraform projects to conduct phishing, compromising an Indian non-crypto IT services company.

Article

North Korea-linked hackers TraderTraitor launch a new round of attacks using malicious Terraform projects

BlockBeats News, September 22: According to a disclosure by SlowMist, the North Korea-linked threat group TraderTraitor (also known as UNC4899 and Jade Sleet) has launched another attack, recently compromising an India-based IT services company unrelated to the crypto industry.

The attackers posted fake job listings through GitHub, using “technical interview assignments” as bait to conduct phishing attacks targeting DevOps and crypto engineers. After victims download the associated project, the malicious .terraform.lock.hcl file points to an attacker-controlled Terraform Provider domain. Running terraform init then triggers the download and execution of a malicious Provider module.

The attack ultimately deploys the Rust/ARM64 backdoors FLATROOF and ROOFDECK on victims’ macOS devices. These two malware families were also previously used in attacks against LayerZero. They can steal credentials and sensitive data, execute Shell commands, collect and exfiltrate files, and obtain access to cloud services and code repositories.

SlowMist warned that TraderTraitor’s targets in this attack are no longer limited to the crypto industry, and that the attackers may be more focused on developers’ cloud and API access permissions for AWS, GCP, OVH, and OpenStack. Companies should handle unfamiliar Terraform Providers and code repositories provided by recruiters with caution, and avoid using personal or corporate development devices to run unverified interview projects.

Original link https://m.theblockbeats.info/flash/368366

Key points

North Korea-linked hackers TraderTraitor launch a new round of attacks using malicious Terraform projects
BlockBeats News, September 22: According to a disclosure by SlowMist, the North Korea-linked threat group TraderTraitor (also known as UNC4899 and Jade Sleet) has launched another attack, recently compromising an India-based IT services company unrelated to the crypto industry.
The attackers posted fake job listings through GitHub, using “technical interview assignments” as bait to conduct phishing attacks targeting DevOps and crypto engineers. After victims download the associated project, the malicious .terraform.lock.hcl file points to an attacker-controlled Terraform Provider domain. Running terraform init then triggers the download and execution of a malicious Provider module.
The attack ultimately deployed the Rust/ARM64 backdoors FLATROOF and ROOFDECK on the victim’s macOS device. These two malware families had also previously been used in attacks on LayerZero. They can steal credentials and sensitive data, execute Shell commands, collect and exfiltrate files, and obtain access to cloud services and code repositories.
SlowMist warned that TraderTraitor’s targets in this attack were no longer limited to the cryptocurrency industry. The attackers may be more interested in cloud and API access held by developers, including access to AWS, GCP, OVH, and OpenStack. Enterprises should handle unfamiliar Terraform Providers and code repositories supplied by recruiters with caution, and avoid using personal or company development devices to carry out unverified interview projects.
Original article: https://m.theblockbeats.info/flash/368366

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

No additional explanation is available beyond the summary.

Why it matters to readers

The report explicitly attributes the activity to the security firm SlowMist and provides technical details including the attack vector, triggering mechanism, malware names, and victim organization type; however, the current material does not include the original investigation report, sample indicators, or confirmation from the victim company, so it is not considered fully verified. The incident shows that the attack scope has expanded from the cryptocurrency industry to ordinary IT service providers, with potential targets including cloud platform, API, and code repository credentials, indicating a high supply-chain risk.

Follow subsequent official information and do not make decisions based on a single message.

Risks and unknowns

Whether SlowMist has published indicators of compromise such as malicious domains, Provider hashes, backdoor samples, and others
Whether the cloud accounts, code repositories, and customer systems of the affected IT services company have been further impacted
Whether GitHub has taken down the relevant fake recruitment accounts and malicious code repositories
Whether more victims from non-crypto industries or infrastructure matching the old LayerZero case have emerged

AT A GLANCE

SlowMist said that the North Korea-linked group TraderTraitor used fake recruitment and malicious Terraform projects to conduct phishing, compromising an Indian non-crypto IT services company.

Article

North Korea-linked hackers TraderTraitor launch a new round of attacks using malicious Terraform projects

Original link https://m.theblockbeats.info/flash/368366

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

No additional explanation is available beyond the summary.

Why it matters to readers

Follow subsequent official information and do not make decisions based on a single message.

Risks and unknowns

Whether SlowMist has published indicators of compromise such as malicious domains, Provider hashes, backdoor samples, and others
Whether the cloud accounts, code repositories, and customer systems of the affected IT services company have been further impacted
Whether GitHub has taken down the relevant fake recruitment accounts and malicious code repositories
Whether more victims from non-crypto industries or infrastructure matching the old LayerZero case have emerged

TraderTraitor Uses Malicious Terraform Project to Compromise Indian IT Services Company

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

TraderTraitor Uses Malicious Terraform Project to Compromise Indian IT Services Company

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Keep following

Security Center