Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

As cited

Copy frozen at 2026-10-09 02:21 UTC (site build).

threat intel

Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

In July 2026, Zscaler ThreatLabz discovered a campaign attributed to TraderTraitor, a North Korean-backed threat actor targeting cryptocurrency developers, that deployed a trojanized Terraform provider to deliver cross-platform malware. The provider downloads a Bash loader that selects platform-specific payloads for macOS, Linux, and Windows, delivering the FLATROOF backdoor and Python information stealers that harvest browser credentials, cookies, and cryptocurrency wallet data before installing the ROOFDECK backdoor. ROOFDECK uses a resilient multi-stage command-and-control discovery process through signed Pastebin files and Nostr profile metadata to evade detection.

Why it matters: Cloud engineers and developers using Terraform face compromise of workstations and CI/CD systems if they load untrusted providers; practitioners should verify Terraform provider checksums and monitor for anomalous process execution to prevent credential theft and persistent backdoor installation.

Source published

2026-10-08 19:49 UTC

First seen by Cybersecurity Tracker

2026-10-08 22:50 UTC