As cited
Copy frozen at (site build).
threat intel
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
SentinelOne identified a second victim infected with the macOS backdoors FLATROOF and ROOFDECK used in the April 2026 TraderTraitor attack on LayerZero. Unlike the cryptocurrency-focused initial victim, this target was an IT services organization in India whose DevOps engineer was compromised through a fake job interview lure containing a weaponized Terraform lock file pointing to attacker-controlled provider registries. The backdoors remained dormant for days after infection, then became active in March, beaconing to command and control servers until June 1, 2026, while the attackers deployed additional stages and ultimately removed the original implants.
Why it matters: DevOps and infrastructure engineers at any organization are now active targets for North Korean state-sponsored actors using fake hiring interviews and weaponized Terraform projects; practitioners must monitor development workstations with cloud credentials and source control access, validate Terraform provider registries against official domains, and educate developers on the supply-chain risks of executing unfamiliar coding projects.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
SentinelOne identified a second victim infected with the macOS backdoors FLATROOF and ROOFDECK used in the April 2026 TraderTraitor attack on LayerZero. Unlike the cryptocurrency-focused initial victim, this target was an IT services organization in India whose DevOps engineer was compromised through a fake job interview lure containing a weaponized Terraform lock file pointing to attacker-controlled provider registries. The backdoors remained dormant for days after infection, then became active in March, beaconing to command and control servers until June 1, 2026, while the attackers deployed additional stages and ultimately removed the original implants.
Why it matters: DevOps and infrastructure engineers at any organization are now active targets for North Korean state-sponsored actors using fake hiring interviews and weaponized Terraform projects; practitioners must monitor development workstations with cloud credentials and source control access, validate Terraform provider registries against official domains, and educate developers on the supply-chain risks of executing unfamiliar coding projects.
- Source published
- First seen by Cybersecurity Tracker