SentinelOne found a second victim of TraderTraitor’s macOS backdoors, showing that the DPRK-linked group also targeted an IT services company through fake job interview lures and weaponized Terraform repositories. The report details how FLATROOF and ROOFDECK were delivered, how ROOFDECK used Nostr-based dead drops and signed commands for C2, and how the campaign relied on typosquatted provider domains and malicious lock files. #TraderTraitor #FLATROOF #ROOFDECK #LayerZero #KelpDAO #Nostr
Keypoints
- SentinelOne identified an additional victim infected with the same macOS backdoors first seen in the LayerZero intrusion.
- The new victim was an IT services company in India, not a cryptocurrency organization, showing broader targeting beyond crypto theft.
- TraderTraitor used fake job interview lures and weaponized GitHub repositories to target developers and DevOps engineers.
- Attackers abused .terraform.lock.hcl files and typosquatted Terraform provider domains to cause victims to download and execute malicious providers.
- FLATROOF and ROOFDECK are ARM64 Rust backdoors for macOS; FLATROOF focused on data theft and ROOFDECK enabled deeper control, reconnaissance, and lateral movement.
- ROOFDECK used Nostr relays and profile-based dead drops to discover its C2 server, and it enforced signed commands with embedded public-key verification.
- The campaign used persistence, anti-forensics, and staged updates, including replacement with a stripped loginwindow variant after the LayerZero disclosure.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The attackers used fake interview coding projects to lure targets into opening weaponized repositories and lock files. (‘fake job interview lures’ and ‘weaponized interview coding project’)
- [T1195.002] Compromise Software Supply Chain – They abused Terraform provider registries and lock files to deliver malicious modules through trusted development workflows. (‘custom Terraform provider registries controlled by the attackers’ and ‘weaponized .terraform.lock.hcl file’)
- [T1059.004] Command and Scripting Interpreter: Unix Shell – FLATROOF could execute shell commands and ROOFDECK supported interactive shell and reverse shell functions. (‘Execute a shell command via execvp’ and ‘Interactive shell via a PTY’)
- [T1055] Process Injection – The article indicates staged implants launching from Cursor and using renderer-like process masquerading, though not classic injection; it describes process abuse for execution. (‘–type=renderer’ and ‘make the implant process appear legitimate’)
- [T1547.013] Boot or Logon Autostart Execution: Launch Agents – ROOFDECK achieved persistence through a LaunchAgents plist. (‘persist … add installs the ~/Library/LaunchAgents/.plist’)
- [T1036] Masquerading – The malware used names like SystemUpdate, iSync, and loginwindow to blend in with legitimate macOS components. (‘deployed under the name SystemUpdate’ and ‘as an executable named loginwindow’)
- [T1112] Modify Registry / Configuration – On macOS, the malware modified quarantine attributes and created configuration entries to enable execution and persistence. (‘removing the com.apple.quarantine attribute’ and ‘sets runtime config live’)
- [T1027] Obfuscated Files or Information – The stripped loginwindow variant removed symbols and debug information to evade detection. (‘stripped symbols and debug information’)
- [T1105] Ingress Tool Transfer – ROOFDECK downloaded staged payloads and updates from attacker-controlled servers. (‘downloads a new binary and self-updates’ and ‘retrieves 3rd-stage loginwindow’)
- [T1071.001] Application Layer Protocol: Web Protocols – ROOFDECK communicated with its C2 via HTTPS endpoints and WebSocket-based transports. (‘Polling for commands is done via HTTPS’ and ‘Transport selector (HTTPS /app_version vs pipe-airway WebSocket)’)
- [T1095] Non-Application Layer Protocol – The implant supported a reverse shell and custom transport mechanisms beyond standard web traffic. (‘Reverse shell — starts/stops a stateful reverse shell back to the operator’)
- [T1005] Data from Local System – FLATROOF harvested browser data, terminal histories, process lists, and keychain content from the host. (‘Chrome, Brave, Firefox, and Safari browser data’ and ‘a raw copy of login.keychain-db’)
- [T1021] Remote Services – The victim’s workstation had access to cloud environments and the malware expanded into AWS and Google Cloud Platform. (‘expand into the victim’s Amazon Web Services and Google Cloud Platform environments’)
- [T1555.003] Credentials from Password Stores: Credentials from Web Browsers – FLATROOF collected browser data and related secrets from local applications. (‘browser data’)
- [T1115] Clipboard Data – ROOFDECK can read and write the macOS clipboard to capture or replace copied secrets. (‘Reads and writes the macOS clipboard’)
- [T1486] Data Encrypted for Impact – The article notes AES-encrypted zips used to stage encrypted exfiltration bundles, though not direct impact encryption. (‘AES-encrypted zips’)
- [T1070.004] File Deletion – The operators removed the original implants and used anti-forensics. (‘loginwindow deletes both original implants (rm -f)’ and ‘Self-destruct’)
Indicators of Compromise
- [SHA1 ] Malware hashes – 02df07a173ab03b82a4fb6a08973fff8b1467f28, c491d477dbe0ae04e9aed9dbe237144c03f73ec4, and 5728b11d30586bbfc1d8bd12df1c722a06e767a2
- [Domain ] C2 and staging domains – technicais.sytes[.]net, storage.hubpage[.]cloud, grenight[.]com, and 3 more domains
- [IP address ] C2 and staging IPs – 176.97.114[.]232, 45.11.59[.]140, and 85.137.56[.]245
- [IP address ] Staging server – 85.137.56[.]10
- [File path ] Malware installation paths – ~/Library/com.apple.iTunesCloud/SystemUpdate, ~/Library/com.apple.internal.ck/iSync, and ~/Library/com.apple.appleaccountd/loginwindow
- [File ] IPC and lock files – /private/tmp/.pipe-airway, $TMPDIR/tmp*.lock
- [Workspace ] Malicious development workspace – ~/DevOps-Automation/cloudshield
- [Config file ] ROOFDECK configuration storage – $HOME/.config/.repl_history
- [Certificate fingerprint ] Custom TLS certificate – SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa and SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82
- [Domain ] Weaponized Terraform provider domains – registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, and registry.hashicorp-terraform[.]io
MITRE Techniques
- [T1204.002] User Execution: Malicious File – The victim ran a weaponized coding project and Terraform init triggered malicious provider execution. (‘When the victim runs terraform init with the weaponized lockfile in place’)
- [T1053.005] Scheduled Task/Job: Scheduled Task – Persistence was configured through a LaunchAgents plist that runs automatically at login. (‘RunAtLoad=true’)
- [T1106] Native API – The implants used native macOS APIs for process, file, clipboard, and system operations. (‘NSPasteboardTypeString’ and ‘proc_listallpids/proc_pidinfo’)
- [T1087] Account Discovery – ROOFDECK gathered host identity and user information during reconnaissance. (‘Aggregate host fingerprint: OS/version, hostname/user’)
- [T1041] Exfiltration Over C2 Channel – FLATROOF exfiltrated files and harvested data via Telegram and ROOFDECK C2 channels. (‘Exfiltrate a file via the Telegram file-attach mechanism’)