HiveForce Labs · Threat Advisory · Actor Report

TraderTraitor Plants Backdoors in the Cloud Engineer's Toolbox

North Korean state-backed TraderTraitor is luring cloud engineers into installing a fake Terraform AWS provider that drops the FLATROOF and ROOFDECK backdoors, stealing cloud keys, credentials and crypto wallets across macOS, Windows and Linux.

Threat Level: RedActor ReportTA2026302Published October 15, 2026Admiralty A1

TA Number

TA2026302

Published

October 15, 2026

Admiralty Code

A1

Threat Level

Red

Report Type

Actor Report

Active Since

2020

Origin

North Korea

Motive

Financial Gain

Malware

FLATROOF, ROOFDECK

01 / Overview

Summary

Threat Actor

TraderTraitor

Targeted Regions

Worldwide

Targeted Platforms

macOSWindowsLinux

Targeted Products

HashiCorp Terraform, Amazon Web Services (AWS), Google Cloud, Cursor, Google Chrome, Microsoft Edge, Brave, Mozilla Firefox, Apple Safari, MetaMask, Phantom, Trust Wallet, Rabby, macOS Keychain, Windows Credential Manager

Targeted Industries

CryptocurrencyFintechVenture CapitalIT ServicesCloud Identity and SaaS Providers

Malware

FLATROOFROOFDECK

02 / Analysis

Actor Details

#01
TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, Slow Pisces, and PUKCHONG) is a North Korean state-backed hacking group, part of the wider Lazarus Group, that steals cryptocurrency for profit. Active since at least 2020, it is linked to some of the biggest crypto thefts on record, including about USD 308 million from DMM Bitcoin in 2024, about USD 1.5 billion from Bybit in 2025, and USD 292 million from KelpDAO in 2026. The group goes after engineers with access to cloud and production systems, reaching them through fake recruiters, job interviews, coding tests, poisoned software packages, and trusted vendors. Its latest trick abuses Terraform, a popular cloud setup tool, by getting developers to install a fake add-on that looks like a genuine AWS component.
#02
Once the fake add-on runs, it quietly downloads a second-stage loader while continuing to work normally, so nothing seems wrong. The loader fetches an encrypted copy of the FLATROOF backdoor disguised as a font file, decrypts it, and bypasses built-in macOS security checks. FLATROOF works on Windows, macOS, and Linux, hides behind names that look like system files, checks for security tools, and sets itself to restart automatically. It then steals data and installs a second backdoor, ROOFDECK, which gives the attackers full remote control, lets them browse and steal files, hunt for wallets and keys, and even swap crypto addresses copied to the clipboard. In one case at an Indian IT company with no crypto ties, the malware started when an engineer opened a project in their code editor, and the attackers later deleted the original files to cover their tracks. Stolen cloud keys then let the group move into AWS and Google Cloud accounts.
#03
The malware focuses on stealing passwords, browser cookies, saved logins, command history, system keychains, and crypto wallet data from extensions such as MetaMask and Phantom, then sends it out through a Telegram bot. FLATROOF keeps three backup ways to receive commands: Telegram, GitHub, and an attacker-run web server. ROOFDECK finds its control server through hidden pointers on Pastebin and the Nostr social network, and only accepts commands signed by the attackers. The impact is serious: one compromised engineer's laptop can expose cloud, code, and wallet access, which this group has repeatedly turned into thefts worth hundreds of millions of dollars. Its appearance at a non-crypto company shows that any organization whose engineers hold cloud access is now a potential target.

Actor Group

Name: TraderTraitor (also tracked as Lazarus, Pressure Chollima, Labyrinth Chollima, Group 77, Hastati Group, Whois Hacking Team, NewRomanic Cyber Army Team, Zinc, Hidden Cobra, Appleworm, APT-C-26, ATK 3, SectorA01, ITG03, TA404, DEV-0139, Guardians of Peace, Gods Apostles, Gods Disciples, UNC577, UNC2970, UNC4034, UNC4736, UNC4899, Diamond Sleet, Citrine Sleet, Jade Sleet, Gleaming Pisces, Slow Pisces, PUKCHONG)
Origin: North Korea
Motive: Financial Gain
Target Regions: Worldwide
Target Industries: Cryptocurrency, Fintech, Venture Capital, IT Services, Cloud Identity and SaaS Providers

03 / Action Plan

Recommendations

01
Hunt for FLATROOF and ROOFDECK Footprints
Sweep macOS, Linux, and Windows hosts for the listed file paths, including ~/Library/com.apple.iTunesCloud/SystemUpdate, ~/Library/com.apple.internal.ck/iSync, ~/Library/com.apple.appleaccountd/loginwindow, $HOME/.config/.repl_history, /private/tmp/.pipe-airway, and $HOME/AppData/Local/Microsoft/Edge/service.exe, along with session.lock or safari_updater in temp directories.
02
Review Persistence Points on Engineering Hosts
Inspect LaunchAgents for com.-prefixed plists that pass --type=renderer with RunAtLoad set to true, check ~/.zlogout for unexpected commands, review the HKCU Run key for a powershell-config-service value, and look for an unfamiliar snap-imagent service on Linux.
03
Lock Down Terraform Provider Sources
Review every .terraform.lock.hcl file and provider source address, treat any registry other than registry.terraform.io or an approved internal mirror as suspect, and enforce a provider_installation block that only allows a vetted network or filesystem mirror.
04
Flag Unusual Child Processes of IDEs and Terraform
Alert when Terraform, Cursor, or other IDEs spawn shells, curl or wget downloads, or unsigned or ad hoc signed binaries from home or temp directories, and when the quarantine attribute is removed with xattr shortly after a download.
05
Watch Dead-Drop and Messaging API Traffic
Monitor for non-browser processes reaching Telegram Bot API, Pastebin raw pages, GitHub API endpoints, or Nostr relays, and for traffic to dynamic DNS providers such as serveftp, servehttp, and sytes, since both implants use these services to fetch tasks and exfiltrate data.

04 / Detection

Indicators of Compromise (IoCs)

Type	Value
`SHA256`	60b3cfe2ec3100caf4afde734cfd5147f78acf58ab17d4480196831db4aa5f18 5b40b73934c1583144f41d8463e227529fa7157e26e6012babd062e3fd7e0b03 f0e8c29e3349d030a97f4a8673387c2e21858cccd1fb9ebbf9009b27743b2e5b 765a79d22330098884e0f7ce692d61c40dfcf288826342f33d976d8314cfd819 e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad 8acd7c2708eb1119ba64699fd702ebd96c0d59a66cba5059f4e089f4b0914925 9ba02f8a985ec1a99ab7b78fa678f26c0273d91ae7cbe45b814e6775ec477598 9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36 89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957
`SHA1`	02df07a173ab03b82a4fb6a08973fff8b1467f28 c491d477dbe0ae04e9aed9dbe237144c03f73ec4 5728b11d30586bbfc1d8bd12df1c722a06e767a2 b2d9ca7b6d1bbbe4864ea11dfca343b7e15597d8 8e67006585e49f51db96604487138e688df732d3 f1606d4d374d7e2ba756bdd4df9b780748f6dc98 f3263451f8988a9b02268f0fb6893f7c41b906d9 ff17bd5abe9f4939918f27afbe0072c18df6db37 3f2c1e60b5fac4cf1013e3e1fc688be490d71a84 ae9f4e39c576555faadee136c6c3b2d358ad90b9 41f855b54bf3db621b340b7c59722fb493ba39a5 d2a77c31c3e169bec655068e96cf4e7fc52e77b8 d5ff73c043f3bb75dd749636307500b60a436550 48a6d5141e25b6c63ad8da20b954b56afe589031
`MD5`	9d78ece09457907b730d139e4e0c64dd 73adaea97f003735335505858c1c6def 116f7189ed7b41f1b339a749d56e63be be60c52ca8a01fef7dc15c2f0ebb77d8 58fa0d651898446d5f5d2ed8a27a3330 2621753691be9521288664bb551dfba6 ad0b1b6d2c8b9d09d6473a4a299470ab 4b8509cde757b5428e5f99c8dffe73ca 3826dc7a9ba8bd5b1c143560c1530d89 34a52e6a4d803e94fe497bab682abfd3 2b81aceab0142472d94eb42e500b27b1 9d88b4494c7bc27b10358b68a899ad54 c2ea5011a91cd59d0396eb4fa8da7d21 930f6f729e5c4d5fb52189338e549e5e 4e5ebbecd22c939f0edf1d16d68e8490 1c7d0ae1c4d2c0b70f75eab856327956 855b2f4c910602f895ee3c94118e979a 9a6307362e3331459d350a201ad66cd9 53d9af8829a9c7f6f177178885901c01 1ca31319721740ecb79f4b9ee74cd9b0 9578c2be6437dcc8517e78a5de1fa975 5d43baf1c9e9e3a939e5defd8f8fbd8d 8397ea747d2ab50da4f876a36d673272
`TLS Certificate SHA256`	`4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa`
`TLS Certificate SHA1`	`4ad92bf92ee614b05c340ce17bef7b6ef5a25e82`
`IPv4`	`176[.]97[.]114[.]232 45[.]11[.]59[.]140 85[.]137[.]56[.]245 85[.]137[.]56[.]10`
`Domains`	diagnose[.]hashicorp-terraform[.]io supportaru[.]serveftp[.]com stage-fashion365[.]vercel[.]app arusupport-region1-webhook[.]online delay[.]servehttp[.]com technicais[.]sytes[.]net storage[.]hubpage[.]cloud grenight[.]com registry[.]hashicorp-aws[.]com registry[.]hashicorp-aws[.]io registry[.]hashicorp-terraform[.]io 185-66-91-112[.]cprapid[.]com 213-111-146-132[.]cprapid[.]com anesthesiaschool[.]com www[.]anesthesiaschool[.]com app[.]heyhay[.]online heyhay[.]online update[.]heyhay[.]online www[.]heyhay[.]online dela[.]servehttp[.]com galaxy-royal[.]online game[.]galaxy-royal[.]online mx01[.]galaxy-royal[.]online ns4[.]galaxy-royal[.]online mactroubleshoots[.]pro www[.]mactroubleshoots[.]pro tinklify[.]com www[.]tinklify[.]com vaimage[.]com wss[.]sytes[.]net www[.]freehealth[.]lat getstockprice[.]com dafom[.]dev tokenais[.]com cryptais[.]com alticgo[.]com esilet[.]com creaideck[.]com aideck[.]net
`URLs`	hxxps[:]//diagnose[.]hashicorp-terraform[.]io/plugins/grpc/v6/schema/metrics/333afe63-c5a2-43f0-b046-7cbaa7797e8a hxxps[:]//supportaru[.]serveftp[.]com/statics/cache/v11/ hxxps[:]//raw[.]githubusercontent[.]com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/ hxxps[:]//stage-fashion365[.]vercel[.]app/static/tinymce4[.]7[.]5/plugins/fonts/v1104/ hxxps[:]//arusupport-region1-webhook[.]online/statics/cache/v11/abicfjej hxxps[:]//pastebin[.]com/raw/3yptBDhL hxxps[:]//github[.]com/exubient0/terraform-candidate-repo/blob/main/[.]terraform[.]lock[.]hcl hxxps[:]//github[.]com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/[.]terraform[.]lock[.]hcl hxxps[:]//github[.]com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/[.]terraform[.]lock[.]hcl hxxps[:]//github[.]com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README[.]md?plain=1#L175 hxxps[:]//github[.]com/Steed-LHV/assessment hxxps[:]//github[.]com/dafomdev hxxps[:]//www[.]alticgo[.]com/update/ hxxps[:]//www[.]esilet[.]com/update/ hxxps[:]//greenvideo[.]nl/wp-content/themes/top[.]php hxxps[:]//dafnefonseca[.]com/wp-content/themes/top[.]php hxxps[:]//haciendadeclarevot[.]com/wp-content/top[.]php hxxps[:]//sche-eg[.]org/plugins/top[.]php hxxps[:]//www[.]vinoymas[.]ch/wp-content/plugins/top[.]php hxxps[:]//infodigitalnew[.]com/wp-content/plugins/top[.]php hxxps[:]//aideck[.]net/board[.]php
`Filenames`	`terraform-provider-awsbeta_v1.0.0 safari_updater session.lock HiraginoSans-Bold.woff HiraginoSans-Regular.woff MalgunGothic-Bold.woff MalgunGothic-Italic.woff NotoSansCJK-Bold.woff NotoSansCJK-ExtraBold.woff NotoSansCJK-Italic.woff NotoSansCJK-Regular.woff imagent update.exe SystemUpdate iSync loginwindow cookie_copy_tool.exe collected_data.zip DAFOM-1.0.0.dmg TokenAIS.app.zip CryptAIS.dmg AlticGO.exe AlticGO_R.exe Esilet.dmg Esilet-tmpzpsb3 Esilet-tmpg7lpp win32.bin darwin64.bin`
`File Path`	`~/Library/com.apple.iTunesCloud/SystemUpdate ~/Library/com.apple.internal.ck/iSync ~/Library/com.apple.appleaccountd/loginwindow ~/Library/LaunchAgents/loginwindow.plist $HOME/.config/.repl_history /private/tmp/.pipe-airway $TMPDIR/tmp*.lock ~/DevOps-Automation/cloudshield $HOME/.config/git/update $HOME/AppData/Local/Microsoft/Edge/service.exe .config/snap/imagent Library/Services/imagent AppData/Local/Microsoft/Windows/PowerShell/config.exe`
`HTTP Request`	`/app_version`

05 / Adversary Behaviour

MITRE ATT&CK TTPs

T1583

Resource Development

Acquire Infrastructure

T1583.001

Acquire Infrastructure › Domains

T1608

Stage Capabilities

T1608.001

Stage Capabilities › Upload Malware

T1566

Initial Access

Phishing

T1566.003

Phishing › Spearphishing via Service

T1195

Supply Chain Compromise

T1195.001

Supply Chain Compromise › Compromise Software Dependencies and Development Tools

T1199

Trusted Relationship

T1204

Execution

User Execution

T1204.002

User Execution › Malicious File

T1059

Command and Scripting Interpreter

T1059.004

Command and Scripting Interpreter › Unix Shell

T1059.006

Command and Scripting Interpreter › Python

T1059.007

Command and Scripting Interpreter › JavaScript

T1546

Persistence

Event Triggered Execution

T1546.004

Event Triggered Execution › Unix Shell Configuration Modification

T1543

Create or Modify System Process

T1543.001

Create or Modify System Process › Launch Agent

T1543.002

Create or Modify System Process › Systemd Service

T1547

Boot or Logon Autostart Execution

T1547.001

Boot or Logon Autostart Execution › Registry Run Keys / Startup Folder

T1098

Account Manipulation

T1098.005

Account Manipulation › Device Registration

T1036

Defense Evasion

Masquerading

T1036.005

Masquerading › Match Legitimate Resource Name or Location

T1036.008

Masquerading › Masquerade File Type

T1027

Obfuscated Files or Information

T1027.009

Obfuscated Files or Information › Embedded Payloads

T1027.013

Obfuscated Files or Information › Encrypted/Encoded File

T1140

Deobfuscate/Decode Files or Information

T1553

Subvert Trust Controls

T1553.001

Subvert Trust Controls › Gatekeeper Bypass

T1553.002

Subvert Trust Controls › Code Signing

T1055

Process Injection

T1055.012

Process Injection › Process Hollowing

T1070

Indicator Removal

T1070.004

Indicator Removal › File Deletion

T1555

Credential Access

Credentials from Password Stores

T1555.001

Credentials from Password Stores › Keychain

T1555.003

Credentials from Password Stores › Credentials from Web Browsers

T1555.004

Credentials from Password Stores › Windows Credential Manager

T1552

Unsecured Credentials

T1552.003

Unsecured Credentials › Shell History

T1539

Steal Web Session Cookie

T1082

Discovery

System Information Discovery

T1057

Process Discovery

T1083

File and Directory Discovery

T1518

Software Discovery

T1518.001

Software Discovery › Security Software Discovery

T1217

Browser Information Discovery

T1580

Cloud Infrastructure Discovery

T1550

Lateral Movement

Use Alternate Authentication Material

T1550.004

Use Alternate Authentication Material › Web Session Cookie

T1115

Collection

Clipboard Data

T1560

Archive Collected Data

T1560.001

Archive Collected Data › Archive via Utility

T1071

Command and Control

Application Layer Protocol

T1071.001

Application Layer Protocol › Web Protocols

T1102

Web Service

T1102.001

Web Service › Dead Drop Resolver

T1102.002

Web Service › Bidirectional Communication

T1008

Fallback Channels

T1573

Encrypted Channel

T1573.001

Encrypted Channel › Symmetric Cryptography

T1105

Ingress Tool Transfer

T1567

Exfiltration

Exfiltration Over Web Service

T1041

Exfiltration Over C2 Channel

T1657

Impact

Financial Theft

06 / Sources

TraderTraitor Plants Backdoors in the Cloud Engineer's Toolbox

TraderTraitor Plants Backdoors in the Cloud Engineer's Toolbox

Summary

Threat Actor

Targeted Regions

Targeted Platforms

Targeted Products

Targeted Industries

Malware

Actor Details

Actor Group

Recommendations

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References & Patch Links

References