SentinelLABS has tied the North Korean cluster it tracks as TraderTraitor — Microsoft's Jade Sleet, Mandiant's UNC4899, also PUKCHONG and Slow Pisces — to the compromise of a small India-based IT services provider with no cryptocurrency ties. The same two Rust macOS backdoors, FLATROOF and ROOFDECK, seen in the March–April 2026 LayerZero/KelpDAO bridge heist (USD 292 million) turned up on a single DevOps engineer's Apple Silicon MacBook.
Initial access came from a weaponized .terraform.lock.hcl file inside a fake job-interview repository: running terraform init pulled a typosquatted "provider" from registry.hashicorp-aws[.]com and executed attacker code. What follows is the full chain — the two implants, their Telegram and Nostr dead-drop C2, the RSA-signed command channel, the stripped anti-forensics variant, the IOCs, and the KQL/SPL hunts to find it.
◈ Table of Contents
01 · Threat Actor Profile
Attribution: HIGHTraderTraitor is a DPRK state-sponsored subgroup within the broader Lazarus umbrella, specialising in developer-targeted intrusions against Web3, DeFi and fintech organisations for cryptocurrency theft. SentinelOne assesses the India intrusion as TraderTraitor with high confidence on the basis of tool overlap with the LayerZero incident and matching operational patterns.
| Attribute | Detail |
|---|---|
| Primary name | TraderTraitor |
| Aliases | Jade Sleet (Microsoft), UNC4899 (Mandiant/Google), PUKCHONG, Slow Pisces |
| Origin | North Korea (DPRK) — Lazarus subgroup |
| Motivation | Financial — cryptocurrency and cloud-credential theft |
| Typical targeting | DevOps / infrastructure engineers in Web3, DeFi and fintech, sourced via social profiles |
| Signature lure | Fake job-interview repositories and coding assessments on GitHub |
| Notable prior ops | KelpDAO / LayerZero bridge heist (USD 292M, 2026); Bybit cold-wallet theft (~USD 1.5B, 2025) |
| Platform focus | Apple macOS on ARM64 (Apple Silicon), plus AWS / GCP / OpenStack cloud |
The tell that separates TraderTraitor from most DPRK crews is platform: they build native ARM64 Rust malware for Apple Silicon, not the usual cross-platform JavaScript/Python droppers. If your macOS fleet skews toward engineering laptops, you are inside their target profile.
02 · Intrusion Timeline
Mar–Jun 2026The intrusion ran for roughly three months on one endpoint. SentinelOne's reconstruction shows the operators gating their activity on the victim's own IDE sessions to blend into legitimate work, then abandoning the host once it proved to hold no crypto value — but only after deploying a third-stage implant and deleting their earlier tooling.
- 12026-03-18 — FLATROOF and ROOFDECK already present on the DevOps engineer's disk.
- 22026-03-25 → 03-28 — Dormant phase; the user is active in their IDE but no malicious activity fires.
- 32026-03-29 05:00 — Engineer opens
~/DevOps-Automation/cloudshieldin Cursor; the IDE spawns login shells (zsh -l) and Node hosts, and the implants execute asSystemUpdateandiSync. - 42026-03-29 05:00:55 — First C2 beacons reach the FLATROOF and ROOFDECK stage-2 servers; Gatekeeper quarantine is stripped seconds later.
- 52026-04-13 — Developer clones the malicious
terraform-candidate-repovia GitHub Desktop. - 62026-04-20 — One day after LayerZero publicly acknowledged the KelpDAO hack, a stripped Stage-3
loginwindowbinary is staged from85.137.56[.]10and beacons togrenight[.]com. - 72026-04-20 13:15 — The Stage-3 binary deletes the original FLATROOF and ROOFDECK implants (anti-forensics).
- 82026-06-01 06:08 — Final observed C2 beacon; on 2026-06-17 the last binary is moved to Trash.
03 · Initial Access — Weaponized Terraform Lock Files
T1195.001The novel access vector here is not a phishing macro or a malicious npm postinstall — it is the Terraform provider-resolution flow itself. The lure is a fake interview repository; the trigger is the command every infrastructure engineer runs first.
A candidate is invited to complete a "take-home" infrastructure exercise hosted on GitHub. The repo ships a pre-populated .terraform.lock.hcl that pins a provider to an attacker-controlled registry. When the victim runs terraform init, Terraform treats that lock file as the source of truth, downloads the malicious provider module, and executes it — no extra clicks, no obvious warning.
Legitimate providers resolve from registry.terraform.io. Any lock file or CLI config pointing provider installation at a third-party host — especially one that looks like a HashiCorp or AWS brand — should be treated as hostile until proven otherwise.
Three brand-alike domains served the malicious provider modules across the campaign's interview repositories. Each impersonates a HashiCorp or AWS namespace closely enough to survive a glance during a coding test.
| Malicious registry | Impersonates |
|---|---|
| registry.hashicorp-aws[.]com | HashiCorp / AWS provider namespace |
| registry.hashicorp-aws[.]io | HashiCorp / AWS provider namespace |
| registry.hashicorp-terraform[.]io | HashiCorp Terraform registry |
SentinelOne enumerated several lure repositories impersonating fictional startups ("Northwind", "Novacart"). One candidate even flagged and removed the typosquatted provider before submitting — an unintended positive signal that the target's engineering hygiene was decent. Known repository names:
- 1
terraform-candidate-repo— hashicorp-aws[.]com provider - 2
gtn-candidate-repo— hashicorp-aws[.]com provider - 3
Northwind-IAC— hashicorp-aws[.]io provider - 4
novacart-interview— fictional ecommerce lure
Treat unsolicited "coding assessment" or "take-home" repos as untrusted code, not documents. Clone and open them only inside a disposable VM with no cloud credentials, no SSH agent, and egress filtering — never on a daily-driver engineering laptop.
04 · FLATROOF Deep Dive
Rust · Telegram C2FLATROOF (also tracked as Gaslight) is the first-stage Rust implant for ARM64 macOS. Its jobs are to collect a first tranche of credentials, exfiltrate over Telegram, and re-arm the second implant. On this host it ran under the masquerade name SystemUpdate.
On execution, FLATROOF immediately clears the macOS quarantine attribute on the ROOFDECK binary and makes it executable — a scripted Gatekeeper bypass so the second stage runs without the "unidentified developer" prompt.
FLATROOF exposes a compact command interface. Shell commands run via execvp; file exfiltration is pushed out through a Telegram bot token embedded in the implant.
| Command | Function |
|---|---|
| help | Display command help |
| id | Identify the implant to the operator |
| shell | Execute shell commands via execvp |
| kill | Terminate a process by PID |
| upload | Exfiltrate files over Telegram |
| stop | Halt the implant |
FLATROOF drops an embedded Python module that sweeps the host for credentials and system context, then ships it out through the same Telegram channel. The keychain copy is the crown jewel — login.keychain-db holds cached secrets, tokens and certificates.
- Browser data from Chrome, Brave, Firefox and Safari
- Terminal command histories
- Installed application listing
- Running-process snapshot (ps aux)
- Full system hardware/software profile (system_profiler)
- A raw copy of login.keychain-db
A copy of ~/Library/Keychains/login.keychain-db being read by a non-Apple, unsigned binary is a high-fidelity compromise signal. Alert on process access to that file from anything outside /System and Apple-signed security tooling.
05 · ROOFDECK Deep Dive
Rust · Nostr dead-dropROOFDECK is the heavyweight second stage: a full-featured Rust backdoor whose standout trait is a dead-drop C2 resolver built on the decentralized Nostr protocol, and a command channel where every instruction is RSA-signed by the operator and verified against an embedded public key before it runs. It launched as iSync.
Rather than hardcode a C2 domain, ROOFDECK reads its operator's profile on the Nostr relay network and pulls the live C2 URL out of the profile's website field. It combines relays discovered from api.nostr[.]watch/v1/online with a hardcoded relay list, then searches for the operator by the Nostr public key stored in its config.
Nostr relay traffic (WebSocket to relay.damus.io, nos.lol, relay.snort.social, etc.) from a corporate macOS endpoint is not normal engineering behavior. It is a rare, high-signal hunt pivot precisely because so few enterprise apps speak Nostr.
ROOFDECK persists its configuration to ~/.config/.repl_history — a name chosen to blend into a developer's dotfiles. The config carries the transport selector, the operator's Nostr identity keys, a Pastebin dead-drop fallback and a provisioned RSA private key.
| Field | Purpose |
|---|---|
| server_url | Resolved / overridden C2 URL |
| connection_type | Transport selector (http | ws) |
| nostr_public_keys | Operator Nostr identity pubkeys |
| recovery_url | Fallback endpoint |
| pastebin_key | Pastebin dead-drop identifier |
| rsa_private_key | Provisioned RSA private key |
| interval | Beacon interval (seconds) |
Every operator command is signed with the operator's private key and verified with an RSA-2048 public key embedded in the binary before execution. This locks out anyone who finds the C2 URL but lacks the private key — including researchers trying to task the implant — and doubles as a version/update check. The embedded key is itself a durable IOC.
ROOFDECK installs a per-user Launch Agent that runs at login. The property list appends a --type=renderer flag so the process reads like a Chromium/Electron helper in a casual process listing.
The --type=renderer masquerade is a hunt anchor: a genuine Chrome renderer is a child of the Chrome parent process and lives under the app bundle. A LaunchAgent-spawned "renderer" running from ~/Library/ with no browser parent is the malware.
ROOFDECK is a complete remote-access toolkit. Beyond arbitrary execution it offers an interactive PTY shell, reverse shell, a background task engine with state tracking, AES-capable archive handling, clipboard read/write, and self-destruct. Notably, its screenshot handler is present but returns an error — the capability was stubbed, not shipped.
| Group | Handlers |
|---|---|
| Session / control | session, config, sleep, tasks, app_version, persist, update, destroy |
| Execution | run, shell (PTY), rssh (reverse shell), kill |
| File system | cd, pwd, ls, find, cat, tail, stat, cp, mv, rm, mkdir, mkfile, chmod, chown, zip/unzip (AES) |
| Transfer | upload, wget |
| Recon / surveillance | info, whoami, uname, uptime, lscpu, df, ps, clipboard, screenshot (stub) |
06 · Stage 3 & Anti-Forensics
T1070.004The timing of the third stage is the story: it landed on 2026-04-20, one day after LayerZero publicly disclosed the KelpDAO hack. The operators reacted to the news cycle by re-tooling for stealth and destroying their earlier footprint.
The Stage-3 binary is a functionally identical ROOFDECK with symbols and debug information stripped, deployed to a fresh masquerade path. After executing, it deleted the original FLATROOF and ROOFDECK binaries — collapsing the forensic timeline down to a single, harder-to-analyse artifact.
| Attribute | Value |
|---|---|
| SHA-1 | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 |
| Path | ~/Library/com.apple.appleaccountd/loginwindow |
| Staged from | 85.137.56[.]10 |
| C2 | grenight[.]com → 85.137.56[.]245 |
| Change | Symbols/debug stripped; deletes prior implants |
Because Stage 3 deletes its predecessors, an endpoint that "only" has the stripped loginwindow artifact has likely already been through the FLATROOF collection phase — assume the keychain and browser credentials were exfiltrated and rotate accordingly.
The C2 servers presented a self-signed TLS certificate generated by mkcert, whose Organizational Unit and Common Name leaked the developer's build environment: user ub on a Linux QEMU/KVM virtual machine (Q35/ICH9). That fingerprint pivots to a cluster of two-dozen related domains — a reminder that even careful operators leave development artifacts in their infrastructure.
07 · C2 Infrastructure & Pivots
3 stages · 2 protocolsThe campaign runs a compartmentalized C2 model: Telegram for FLATROOF exfiltration, Nostr dead-drop plus HTTPS for ROOFDECK tasking, and a distinct Stage-3 domain. The shared mkcert certificate ties an outer ring of domains together.
| Stage / role | Domain | IP |
|---|---|---|
| FLATROOF C2 | technicais.sytes[.]net | 176.97.114[.]232 |
| ROOFDECK C2 (stage 2) | storage.hubpage[.]cloud | 45.11.59[.]140 |
| ROOFDECK C2 (stage 3) | grenight[.]com | 85.137.56[.]245 |
| Staging server | — | 85.137.56[.]10 |
SentinelOne pivoted on the "ub" mkcert certificate to surface a wider set of domains that served the same TLS material — spanning fake tech-support brands, health-themed decoys and CDN-style hostnames. Treat these as related infrastructure for retroactive log hunts.
| Certificate-linked domains |
|---|
| grenight[.]com · storage.hubpage[.]cloud · mactroubleshoots[.]pro · www.mactroubleshoots[.]pro |
| heyhay[.]online · app.heyhay[.]online · update.heyhay[.]online · www.heyhay[.]online |
| galaxy-royal[.]online · game.galaxy-royal[.]online · mx01.galaxy-royal[.]online · ns4.galaxy-royal[.]online |
| anesthesiaschool[.]com · www.anesthesiaschool[.]com · tinklify[.]com · www.tinklify[.]com |
| vaimage[.]com · www.freehealth[.]lat · dela.servehttp[.]com · wss.sytes[.]net |
| 185-66-91-112.cprapid[.]com · 213-111-146-132.cprapid[.]com |
08 · Post-Exploitation & Cloud Pivot
Why the endpoint mattersOn the India victim, TraderTraitor assessed the host as low-value — no crypto, no bridge access — and abandoned it after Stage 3. But the LayerZero incident that used the identical toolset shows the intended endgame when the target does hold value: a laptop foothold that pivots straight into multi-cloud infrastructure.
Credential Harvest
FLATROOF/ROOFDECK collect keychain secrets, browser sessions and API keys (AWS, OVH, OpenStack) from the engineer's machine.
Multi-Cloud Expansion
In the LayerZero breach the actor used stolen keys to move into AWS and Google Cloud environments — the laptop was just the doorway.
Transaction Abuse
Cloud access was paired with a DDoS to force an illegitimate mint approval, enabling the USD 292M KelpDAO theft.
Target Triage
The non-crypto victim reveals opportunistic casting: infect broadly via interviews, then keep only hosts with cloud or bridge value.
09 · Indicators of Compromise
Hashes · paths · netSentinelOne published SHA-1 hashes for the three core binaries plus host and network artifacts. Because Stage 3 deletes its predecessors, hunt on the file paths and Launch Agent pattern as strongly as on the hashes.
| SHA-1 | Malware | Variant |
|---|---|---|
| 02df07a173ab03b82a4fb6a08973fff8b1467f28 | FLATROOF | SystemUpdate |
| c491d477dbe0ae04e9aed9dbe237144c03f73ec4 | ROOFDECK | iSync |
| 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | ROOFDECK | loginwindow (stripped) |
| Artifact | Path |
|---|---|
| FLATROOF | ~/Library/com.apple.iTunesCloud/SystemUpdate |
| ROOFDECK (orig.) | ~/Library/com.apple.internal.ck/iSync |
| ROOFDECK (stripped) | ~/Library/com.apple.appleaccountd/loginwindow |
| Config | $HOME/.config/.repl_history |
| IPC pipe | /private/tmp/.pipe-airway |
| Lock file | $TMPDIR/tmp*.lock |
| Persistence | ~/Library/LaunchAgents/*.plist (args contain --type=renderer, RunAtLoad=true) |
| Malicious workspace | ~/DevOps-Automation/cloudshield |
| Type | Value |
|---|---|
| Domain | technicais.sytes[.]net · storage.hubpage[.]cloud · grenight[.]com |
| IP | 176.97.114[.]232 · 45.11.59[.]140 · 85.137.56[.]245 · 85.137.56[.]10 |
| Provider registries | registry.hashicorp-aws[.]com · registry.hashicorp-aws[.]io · registry.hashicorp-terraform[.]io |
| Nostr relays | wss://relay.damus[.]io · wss://nos[.]lol · wss://nostr[.]mom · wss://relay.snort[.]social · wss://offchain[.]pub · wss://relay.nostr[.]band · wss://nostr.oxtr[.]dev · wss://nostr[.]wine |
| Relay discovery | api.nostr[.]watch/v1/online |
| TLS cert (SHA-256) | 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa |
10 · Detection & Hunt Queries
KQL + SPL pairsThese hunts assume macOS endpoint telemetry via Microsoft Defender for Endpoint (advanced hunting) and a Splunk deployment ingesting macOS process/file events (osquery, MDE streaming, or Unified Logs). Every query is paired KQL + SPL and prefixed with what it finds. Tune paths/hashes to your environment.
--type=renderer masquerade but has no legitimate browser parent.Layer the network hunt over the host hunt: a single macOS device that both resolves a hashicorp-aws[.]* typosquat and later opens WebSocket sessions to Nostr relays is almost certainly this chain — that two-signal correlation cuts false positives to near zero.
11 · MITRE ATT&CK Mapping
macOS techniques| Tactic | Technique | ID |
|---|---|---|
| Resource Development | Acquire Infrastructure: Domains | T1583.001 |
| Resource Development | Develop Capabilities: Malware | T1587.001 |
| Initial Access | Supply Chain Compromise: Software | T1195.001 |
| Initial Access | Phishing: Spearphishing Link | T1566.002 |
| Execution | User Execution: Malicious File | T1204.002 |
| Execution | Command & Scripting: Unix Shell | T1059.004 |
| Persistence | Boot/Logon Autostart: Launch Agent | T1547.014 |
| Privilege Escalation / Evasion | Abuse Elevation Control: Gatekeeper Bypass | T1548.001 |
| Defense Evasion | Masquerading: Task/Service | T1036.004 |
| Defense Evasion | Indicator Removal: File Deletion | T1070.004 |
| Credential Access | Credentials from Web Browsers | T1555.003 |
| Credential Access | Credentials from Keychain | T1555.001 |
| Credential Access | Steal Application Access Token | T1528 |
| Discovery | System Information Discovery | T1082 |
| Collection | Clipboard Data | T1115 |
| Command & Control | Dead Drop Resolver (Nostr) | T1008 |
| Command & Control | Application Layer Protocol: HTTPS | T1071.001 |
| Exfiltration | Exfiltration Over Web Service | T1567.002 |
12 · Mitigation & Hardening
Do this nowBecause the payoff is cloud credentials, treat any confirmed FLATROOF/ROOFDECK host as a cloud-key compromise, not just a malware cleanup.
- 1Isolate the endpoint; capture memory and the
~/Libraryartifacts before wiping. - 2Rotate everything the keychain touched — AWS/OVH/OpenStack keys, cloud SSO sessions, SSH keys, browser-stored tokens, and any signing credentials.
- 3Revoke and re-issue Git provider tokens; review CloudTrail / GCP audit logs for access from the C2 IPs and unfamiliar regions.
- 4Remove the Launch Agent plist and all masquerade binaries under
~/Library/com.apple.*.
- 1Pin providers to
registry.terraform.ioand enforce it with a.terraformrcprovider_installationblock or a private mirror; block network installs from unknown registries. - 2Run untrusted repos and take-home assessments only in disposable VMs with no cloud credentials, no SSH agent, and egress filtering.
- 3Alert on outbound connections to Nostr relays and typosquatted
hashicorp-*hostnames from any endpoint. - 4Enforce full Gatekeeper/notarization policy via MDM and alert on
xattr -rd com.apple.quarantineexecutions.
The strongest single control for this actor is process isolation for "job interview" code. TraderTraitor's entire model depends on a target running attacker code on a machine that also holds production cloud keys. Separate those two things and the chain dies at step one.
13 · Sources & References
Primary intelHunting DPRK developer-targeted intrusions across your macOS fleet?
Run the FLATROOF/ROOFDECK hashes, domains and Nostr-relay indicators from this report through the CyberHawk IOC Scanner, then track the wider TraderTraitor campaign on our Threat Intel feed. For the response playbook, see the CyberHawk SOP library on infostealer and cloud-credential compromise.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."