@zscalerinc.bsky.social
Trojanized Terraform delivers FLATROOF and ROOFDECK across macOS, Linux, and Windows.
-
IOCs: hashicorp-terraform[.]io, arusupport-region1-webhook[.]online, delay[.]servehttp[.]com
-
#Malware #ThreatIntel #TraderTraitor

"Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware" published by Zscaler. #TraderTraitor, #FLATROOF, #ROOFDECK https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver

"How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group" published by ZachXBT. #TraderTraitor, #MoneyLaundering, #Lazarus, #Bybit, #Bitget https://x.com/zachxbt/status/2107081638073319437

"Bitget Loses USD 351.6 Million in Hot Wallet Breach in Likely North Korea Attack" published by Trmlabs. #TraderTraitor, #Bitget https://www.trmlabs.com/resources/blog/bitget-loses-usd-3516-million-in-hot-wallet-breach-in-likely-north-korea-attack

SentinelOne discovered how new TraderTraitor macOS backdoors hit IT firms. Learn how TraderTraitor macOS backdoors use weaponized Terraform files.

#TraderTraitor #macOSMalware #CyberSecurity #SentinelOne #Lazarus

TraderTraitor used counterfeit Terraform tests to install FLATROOF, ROOFDECK backdoors on macOS devs—cloud access compromised early. #CloudSecurity #macOSMalware #DevSecOps #TraderTraitor thedailytechfeed.com/tradertraito...

SentinelOne found a second TraderTraitor victim: an IT services firm hit by macOS backdoors via fake job interviews and weaponized Terraform repos. FLATROOF and ROOFDECK used Nostr dead drops and signed C2 commands. #TraderTraitor #ROOFDECK

"Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties" published by SentinelOne. #TraderTraitor, #FLATROOF, #ROOFDECK https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties

@sentinelone.com
DPRK actors used fake job lures and weaponized Terraform files to deploy FLATROOF and ROOFDECK on developer Macs.
-
IOCs: grenight[.]com, 176[.]97[.]114[.]232, 45[.]11[.]59[.]140
-
#Malware #ThreatIntel #TraderTraitor