TraderTraitor’s macOS Backdoors Hit Non-Crypto IT Firm After LayerZero Hack
George antony 
North Korea’s TraderTraitor subgroup didn’t stop after allegedly helping engineer the USD 292 million LayerZero/KelpDAO heist disclosed in April 2026.
SentinelOne’s LABScon research, published September 18, 2026, by Albert Priego, Alex Delamotte, and Matej Havranek, reveals the same macOS backdoors FLATROOF and ROOFDECK turned up on an Indian IT services firm with no cryptocurrency ties whatsoever, exposing a broader, opportunistic targeting pattern behind the DPRK-linked Lazarus offshoot.
The intrusion followed the now-familiar Contagious Interview playbook: operators posing as recruiters lured a DevOps engineer with a fake take-home coding assignment.
TraderTraitor’s macOS Backdoors Hit Non-Crypto IT Firm
SentinelOne traced additional weaponized GitHub repositories beyond LayerZero’s originally disclosed gtn-candidate-repo, including Northwind-IAC, novacart-interview, and terraform-candidate-repo, each themed around fictitious or impersonated companies to make the “interview task” feel legitimate.
The actual weapon was buried in a .terraform.lock.hcl file. By pointing to attacker-controlled provider registries registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, and registry.hashicorp-terraform[.]io running terraform init silently pulled and executed malicious provider code instead of the legitimate HashiCorp registry.
In one repository, a security-aware candidate actually stripped out a typosquatted provider before submitting, suspecting a deliberate awareness test.
Unlike LayerZero, the newly identified victim was a modest IT services provider. The single compromised endpoint an Apple Silicon MacBook belonging to a DevOps engineer who routinely ran Terraform and Ansible against AWS, OVH, and OpenStack held exactly the kind of cloud and source-control access TraderTraitor covets.
Telemetry showed FLATROOF and ROOFDECK sitting dormant on disk from March 18 until March 29, when opening a Cursor IDE workspace triggered execution within seconds, followed by C2 beaconing to attacker infrastructure and Gatekeeper bypass via quarantine-attribute stripping.
Notably, on April 20, one day after LayerZero went public with the KelpDAO incident, the attackers pushed a stripped, symbol-free version of ROOFDECK, deleted the original implants, and shifted C2 to grenight[.]com, a plausible reaction to the sudden publicity.
Beaconing petered out by June 1, and the loginwindow binary was trashed on June 17, suggesting the operators concluded this target lacked the payout potential of a DeFi bridge.
FLATROOF is an ARM64 Rust backdoor also tracked on macOS.Gaslight handles initial reconnaissance, harvesting browser data, terminal history, keychain files, and running a Telegram-based exfiltration channel before disabling quarantine protections on its more capable companion.
ROOFDECK is the heavier-duty implant, resolving its command-and-control address through Nostr relay dead-drops, persisting via a disguised LaunchAgent plist, and supporting an extensive command set covering shell access, reverse shells, file manipulation, clipboard hijacking (useful for swapping copied wallet addresses), and encrypted archive staging.
A sloppy mkcert TLS certificate even leaked the operator’s Linux VM username, “ub,” letting researchers pivot to related infrastructure.
The core lesson: TraderTraitor’s supply-chain lures aren’t reserved for crypto firms. Any engineer whose laptop reaches cloud infrastructure, CI/CD pipelines, or source repositories is a viable target.
SentinelOne recommends treating cloud-privileged engineers as a sensitive monitoring group, auditing unsigned binaries launched from home directories or IDE child processes, restricting take-home interview assignments to non-corporate devices, and manually verifying any Terraform provider registry outside the official registry.terraform.io namespace before running terraform init.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
