--- url: "https://www.xcademia.com/news/tradertraitor-backdoors-resurface-in-attack-on-non-crypto-it-firm" title: "TraderTraitor Backdoors Resurface in Attack on Non-Crypto IT Firm" description: "SentinelOne uncovers TraderTraitor macOS backdoors targeting a non-crypto IT firm through fake interviews and weaponized Terraform projects." publishedAt: "2026-09-21T10:18:42.707+00:00" updatedAt: "2026-09-21T12:34:50.045195+00:00" type: news category: cybersecurity source_name: SentinelLabs source_url: "https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/" tags: - "#Cybersecurity" - "#TraderTraitor" - "#DPRK" - "#macOSMalware" - "#SupplyChainSecurity" - "#Terraform" - "#DevSecOps" - "#CloudSecurity" --- # TraderTraitor Backdoors Resurface in Attack on Non-Crypto IT Firm > SentinelOne uncovered TraderTraitor backdoors on an Indian IT services provider with no cryptocurrency ties, revealing how fake coding interviews and weaponized Terraform projects can turn developer endpoints into gateways to cloud environments. Source: **SentinelLabs** · 21 September 2026 ## TraderTraitor Backdoors Resurface on a Non-Crypto Victim The financially motivated DPRK-aligned threat actor known as TraderTraitor has expanded beyond its better-known cryptocurrency targets, according to new research from SentinelOne. SentinelOne said it identified the same macOS backdoors associated with the group's earlier LayerZero intrusion on an unrelated IT services provider in India. The organisation had no cryptocurrency connection, but one of its DevOps engineers used an Apple Silicon MacBook with access to cloud infrastructure and source-code repositories. The finding is significant because it illustrates how attackers can target **developer access rather than a specific industry**. In this case, the potential value of the compromised endpoint came from the infrastructure and credentials accessible from the machine. ### From cryptocurrency targets to developer endpoints TraderTraitor, also tracked as UNC4899, PUKCHONG and Jade Sleet, has been associated with DPRK-linked activity targeting cryptocurrency organisations. SentinelOne references the April 2026 LayerZero incident, where the attackers compromised infrastructure and ultimately stole cryptocurrency. The security company subsequently searched its telemetry for the macOS backdoors associated with that campaign and found them on another victim. The second victim was an IT services provider in India rather than a cryptocurrency company. SentinelOne identified a single affected endpoint belonging to a DevOps engineer. The system was used to run Terraform and Ansible against AWS, OVH and OpenStack and had access to cloud credentials and source control. This changes the way the attack surface should be understood. The attacker did not necessarily need the organisation to hold cryptocurrency. Access to a developer workstation could provide another route into cloud infrastructure, source code and deployment environments. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789985853122-info1--3---1-.webp) ### Fake job interviews became the entry point SentinelOne says the campaigns use social engineering built around fake job interviews, a tactic associated with DPRK-linked "Contagious Interview" activity. The targets identified by the researchers had GitHub profiles associated with DevOps, cryptocurrency or FinTech engineering projects. Instead of sending a conventional malicious attachment, the attackers created coding projects designed to resemble legitimate infrastructure engineering assessments. The repositories identified by SentinelOne included: - `Northwind-IAC` - `novacart-interview` - `terraform-candidate-repo` The researchers noted that it was unclear whether some of the named companies were fabricated or whether the attackers were impersonating real organisations. This approach makes the attack particularly relevant to developers. A coding assignment can appear legitimate because the victim expects to download source code, install dependencies and execute development tools. The malicious activity can therefore become embedded within what looks like a normal technical evaluation. ### Weaponized Terraform lock files The key technical element identified by SentinelOne was the abuse of Terraform's dependency mechanism. The malicious repositories contained a weaponized `.terraform.lock.hcl` file. Instead of relying solely on legitimate Terraform provider infrastructure, the lock file pointed to attacker-controlled, typosquatted provider domains. SentinelOne identified three malicious domains: - `registry.hashicorp-aws[.]com` - `registry.hashicorp-aws[.]io` - `registry.hashicorp-terraform[.]io` When a victim runs `terraform init` with the malicious lock file, Terraform can use the specified custom provider and download the malicious provider module. This is an important distinction from a simple malicious executable. The attacker effectively places the malicious component inside a development workflow that the victim may already consider trustworthy. SentinelOne also found evidence that developer awareness can interrupt this technique. In one repository, a candidate removed a typosquatted provider from the lock file after recognising it as suspicious. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789985873248-info2--3---1-.webp) ## FLATROOF and ROOFDECK on macOS SentinelOne identified two macOS backdoors on the victim system: **FLATROOF** and **ROOFDECK**. Both are ARM64 macOS backdoors written in Rust. FLATROOF was found under the filename `SystemUpdate` and was located in a path designed to resemble an Apple-related component. Its role included initial data collection and deployment of secondary payloads. SentinelOne observed FLATROOF removing the `com.apple.quarantine` attribute from ROOFDECK and setting its executable permission, allowing the second implant to execute without the normal quarantine-related prompt. The malware's data collection capabilities included browser data from Chrome, Brave, Firefox and Safari, terminal command histories, installed applications, running processes, system information and a copy of the macOS `login.keychain-db`. Data could be exfiltrated through Telegram using a built-in bot token. ### ROOFDECK ROOFDECK provided broader capabilities. It was deployed as `iSync` and used a configuration file containing information needed to locate its command-and-control infrastructure. SentinelOne found that it could use Nostr infrastructure to discover an operator-controlled profile and retrieve a C2 URL from the profile's website field. The backdoor also supported persistence through a macOS LaunchAgent plist and used a `--type=renderer` argument to make the process appear more legitimate. Its command set included system reconnaissance, shell execution, file discovery, file transfer, process management, persistence, updates and other remote-control functionality. ### The intrusion timeline SentinelOne's telemetry provides a detailed timeline. The backdoors were already present on the system by **March 18, 2026**, although the researchers could not establish exactly how they were initially delivered. Activity began on March 29. The developer opened a `cloudshield` workspace in Cursor, after which Cursor spawned shell processes and then launched both `SystemUpdate` and `iSync`. The implants subsequently connected to their command-and-control infrastructure. The researchers observed continued beaconing through April. On April 13, the developer cloned another Terraform-related GitHub repository. A new version of ROOFDECK was later staged on April 20, one day after LayerZero publicly announced its incident. That newer implant subsequently removed the original FLATROOF and ROOFDECK binaries. SentinelOne described the new version as functionally similar but stripped of symbols and debugging information. The final observed C2 activity occurred on June 1, according to SentinelOne's telemetry. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1789985900189-info3--4---1-.webp) ## Why the cloud connection matters The most important lesson from the incident is not simply that macOS malware was involved. The developer endpoint was connected to infrastructure. The affected engineer used Terraform and Ansible to manage multiple cloud environments and had access to source control. SentinelOne therefore describes the value of the target in terms of what the compromised laptop could reach. This reflects a broader security challenge for modern engineering organisations. A developer workstation can sit at the intersection of: - Source repositories - Cloud credentials - Infrastructure-as-code - CI/CD systems - Cloud management consoles - Deployment credentials - Internal development environments Compromising that workstation can therefore provide an attacker with opportunities that extend well beyond the endpoint itself. The incident also shows why supply-chain security cannot be limited to public package registries. Development repositories, coding assessments, lock files and infrastructure providers can all become part of an attack path. ## SentinelOne's recommendations SentinelOne recommends treating engineers with cloud engineering permissions and source-control access as a sensitive group for endpoint monitoring. The company specifically recommends looking for: - Unsigned binaries executing from user home directories - Unexpected child processes launched by IDEs - Outbound TLS connections from those processes - Suspicious interview take-home assignments - Unsolicited repositories provided to developers It also recommends considering policies around using corporate workstations for external job interviews and strengthening security-awareness training for developers with sensitive access. For developers working with Terraform, SentinelOne recommends checking that providers referenced by `.terraform.lock.hcl` files belong to known, legitimate namespaces. The researchers also caution that malicious packages can potentially be hosted through legitimate provider infrastructure, meaning developers should investigate the source of providers and modules rather than relying only on the domain itself. ## What this means for organisations The announcement highlights a broader industry shift toward targeting **developer workflows as an access path into cloud environments**. The attack chain described by SentinelOne combines social engineering, software supply-chain manipulation, developer tooling and endpoint malware. For enterprises, this could mean that security monitoring needs to extend beyond traditional server and network telemetry. Developer machines can have privileged access to infrastructure that is otherwise difficult for an attacker to reach. The report also demonstrates why security teams should consider the context in which software is executed. A repository supplied during a job interview may appear unrelated to the company's production environment. But if it is executed on a corporate workstation containing cloud credentials, its security implications are very different. The company did not provide specific information about how the initial compromise occurred on the additional victim's machine. SentinelOne explicitly states that the backdoors were present by March 18 but that the researchers could not prove how they were delivered. That distinction is important when interpreting the findings. ## Final takeaway The TraderTraitor activity described by SentinelOne demonstrates how an attacker can combine **fake recruitment activity, weaponized Terraform projects and macOS backdoors** to target developers rather than directly attacking a company's production infrastructure. The victim in this investigation had no cryptocurrency ties. Yet its DevOps endpoint provided access to cloud and source-control resources, making the developer workstation itself a valuable target. For security teams, the practical lesson is straightforward: developer endpoints should be treated as part of the cloud security boundary, particularly when they have access to infrastructure-as-code, source repositories and cloud credentials. ## Original source https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/ ## Tags `#Cybersecurity` · `#TraderTraitor` · `#DPRK` · `#macOSMalware` · `#SupplyChainSecurity` · `#Terraform` · `#DevSecOps` · `#CloudSecurity` --- ## About this content This Markdown news article is the citation-grade twin of [TraderTraitor Backdoors Resurface in Attack on Non-Crypto IT Firm](https://www.xcademia.com/news/tradertraitor-backdoors-resurface-in-attack-on-non-crypto-it-firm). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/tradertraitor-backdoors-resurface-in-attack-on-non-crypto-it-firm - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt