Trojanized Terraform Provider Delivers FLATROOF and ROOFDECK Malware, Linked to TraderTraitor

A suspected TraderTraitor campaign has turned a trusted infrastructure-as-code tool into a delivery vehicle for cross-platform backdoors. Zscaler ThreatLabz published its findings on October 8, 2026, and says it first uncovered the activity in July 2026.

Attackers modified a trusted Terraform provider to distribute malicious code. Developers who downloaded or used the compromised provider could unknowingly execute malware. This attack exploits trust in legitimate infrastructure-as-code tools. It can put cloud environments and development systems at risk.

The compromised provider delivers two malware families known as FLATROOF and ROOFDECK. These malicious programs can help attackers gain unauthorized access to infected systems. Such malware may be used to collect sensitive information and support further malicious activities. The incident highlights the risks of compromised software dependencies.

Trojanized Terraform Provider Delivers FLATROOF and ROOFDECK Malware

Researchers linked the campaign to TraderTraitor, also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces. That North Korean state-backed group has targeted the cryptocurrency industry for years. The campaign overlaps with the earlier KelpDAO incident, which involved the same FLATROOF and ROOFDECK malware families.

The attackers used a fake Terraform provider to run a Bash loader. The loader selects malware that matches the victim’s operating system. FLATROOF then steals data with Python scripts before dropping the ROOFDECK backdoor for full remote control.

The initial payload is a Go binary named terraform-provider-awsbeta_v1.0.0, which poses as an AWS provider. The attackers added a malicious package called awsbeta and called it directly from main. The code therefore runs as soon as Terraform loads the provider.

A session.lock file in the temp directory acts as a run-once marker. If it is absent, the provider downloads a Bash script from the lookalike domain hashicorp-terraform[.]io. It saves the script as safari_updater, launches it as a detached process, and creates the lock. Meanwhile, the provider keeps behaving normally, so the victim may notice nothing.

The loader supports macOS, Linux, and Windows systems running Unix-like shells such as Cygwin, MinGW, or MSYS. It maps each OS and CPU architecture to a font-style filename. An example is HiraginoSans-Regular.woff for an ARM64 Mac. Each .woff file holds decoy font data, then the marker @@ENDFONT@@, then an encrypted executable.

The loader decrypts the payload with AES-256-CBC. It can use Python, Node.js, Perl, or OpenSSL, depending on what is installed. It tries three download sources in turn: a dynamic DNS host, a GitHub repository, and a Vercel-hosted site. On macOS it also strips the quarantine attribute and applies an ad hoc code signature.

Payloads land in paths that mimic legitimate components:

FLATROOF is a Rust-based backdoor with a shared code layout across all three platforms. It can communicate with its operators via the Telegram Bot API, GitHub API polling, or an HTTP webhook. Persistence uses a service on Linux, a shell logout mechanism on macOS, and a registry Run value on Windows.

Its embedded Python stealers go after browser databases from Chromium-based browsers and Firefox, plus shell history and system details. The Windows version also targets Credential Manager and wallet extensions for MetaMask, Phantom, Trust Wallet, and Rabby. The macOS version takes the login keychain file. ThreatLabz noted that verbose comments and emojis in the scripts suggest an LLM may have helped write them.

ROOFDECK is notable for its resilient command-and-control (C2) discovery. It checks a local configuration file first. It can then fetch a Pastebin dead drop containing an encrypted address and an RSA signature, and it verifies the signature before accepting the address. If Pastebin fails, it queries Nostr profile metadata, where a profile named “tulip” pointed to the same Pastebin URL.

ThreatLabz sees substantial overlap in tactics and targeting with TraderTraitor. It has found no unique code similarities, shared infrastructure, or cryptographic links that would support high-confidence attribution. SentinelLabs independently reported related activity involving weaponized Terraform projects.

Zscaler advises organizations to restrict untrusted Terraform providers and verify provider checksums. It also advises monitoring for unexpected process activity on developer workstations. Zscaler Cloud Sandbox detects the campaign, and the threat names are OSX.Backdoor.FLATROOF and OSX.Backdoor.ROOFDECK.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.

About the Author

George antony

Author

Visit Website View All Posts