"Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware" published by Zscaler. #TraderTraitor, #FLATROOF, #ROOFDECK https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver

Trojanized Terraform provider hides backdoors in .woff font files - cloud engineers beware. https://intel.threadlinqs.com/threat/TL-2026-3071 #ThreatIntel #FLATROOF #ROOFDECK #Trojanized

DPRK's Jade Sleet weaponized a fake job interview to drop macOS backdoors - one hides C2 inside Nostr relays. https://intel.threadlinqs.com/threat/TL-2026-2599 #ThreatIntel #FLATROOF #ROOFDECK #BONZAI

SentinelOne found a second TraderTraitor victim: an IT services firm hit by macOS backdoors via fake job interviews and weaponized Terraform repos. FLATROOF and ROOFDECK used Nostr dead drops and signed C2 commands. #TraderTraitor #ROOFDECK

"Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties" published by SentinelOne. #TraderTraitor, #FLATROOF, #ROOFDECK https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties