Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
Do Son 
Infection chain delivering FLATROOF and ROOFDECK through a trojanized Terraform provider | Image: Zscaler ThreatLabz
| At a glance | |
| Actor | Suspected TraderTraitor (Jade Sleet, UNC4899, Pressure Chollima, Slow Pisces) |
| Activity | Trojanized developer tool delivering a stealer and backdoors |
| Targets | Cloud engineers and cryptocurrency or Web3 developers who use Terraform |
| Scale | Not disclosed |
| Status | No law-enforcement action reported; attribution not at high confidence |
| Source | Zscaler ThreatLabz, with related findings from SentinelLabs |
TL;DR
In July 2026, Zscaler ThreatLabz found a trojanized Terraform provider posing as an AWS plugin. Once Terraform loads it, the fake provider installs malware on macOS, Linux, or Windows. Researchers link the activity to suspected North Korean group TraderTraitor, but not with high confidence.
What happened
The malicious file, named terraform-provider-awsbeta, imitates an Amazon Web Services provider for HashiCorp Terraform. Providers are plugins that let Terraform talk to cloud services. Because of that role, they often run on developer laptops and build servers.
As ThreatLabz notes, “Terraform provider binaries execute on developer workstations and CI/CD systems.” The researchers still do not know how the file reached its victims. However, the choice of tool suggests the campaign targets cloud engineers.
A plugin that keeps working
The attackers built a working provider and added a hidden package to it. As soon as Terraform starts the plugin, the hidden code runs once. It downloads a Bash script from the lookalike domain hashicorp-terraform[.]io and launches it in the background. Meanwhile, the provider keeps responding as normal, so victims may notice nothing.
Malware hidden in font files
Next, the Bash loader checks the operating system and CPU type. It then fetches a matching payload disguised as a web font file. The loader tries three public hosts in turn: a dynamic DNS address, a GitHub repository, and a Vercel site.
Each fake font hides an encrypted program behind a marker string. The loader extracts and decrypts it with whatever tool exists on the machine, such as Python, Node.js, Perl, or OpenSSL. On macOS, it also strips the quarantine flag and signs the file before running it.
FLATROOF steals, ROOFDECK stays
The first payload is FLATROOF, a Rust backdoor for all three platforms. It sets up persistence and talks to its operators through Telegram, GitHub, or a web hook. In addition, it runs Python scripts that steal browser passwords, cookies, shell history, and system details. On Windows, the scripts also grab data from MetaMask, Phantom, and Rabby wallet extensions.
Interestingly, ThreatLabz says the scripts’ emojis and verbose comments hint at code written with help from a large language model.
FLATROOF then drops ROOFDECK, a second backdoor for Windows and macOS. ROOFDECK finds its server in layers. It first checks a local file, then a signed Pastebin note, and finally Nostr profile data. The digital signature stops outsiders from hijacking infected machines through the Pastebin note.
Once connected, ROOFDECK gives operators broad control. It can run shell commands, open a reverse shell, and move or upload files. It also reads and changes clipboard contents. Operators can update the agent, change its settings, or wipe it when they finish. Together, these features turn one trojanized Terraform provider into long-term access.
Who is behind it
TraderTraitor is a North Korean state-backed group that has hit the cryptocurrency industry for years. This campaign shares tactics and targets with that group. It also overlaps with the KelpDAO incident, where analysts first described FLATROOF and ROOFDECK. Separately, SentinelLabs reported related TraderTraitor activity with weaponized Terraform projects.
Still, the attribution remains suspected. ThreatLabz says it has not found “unique code similarities, shared infrastructure, or cryptographic links” strong enough to tie the campaign to TraderTraitor with high confidence.
Impact and scale
Neither ThreatLabz nor SentinelLabs has published victim counts or loss figures for this campaign. Even so, the risk is high for any team that runs Terraform. A single infected workstation can expose cloud keys, browser sessions, and crypto wallets. Moreover, a compromised build server could give attackers a path into production systems.
The campaign also fits a wider pattern. Suspected TraderTraitor operations have used fake job offers, poisoned Python packages, and trojanized apps to reach developers.
How to stay protected
- Install Terraform providers only from the official registry or trusted internal mirrors.
- Verify provider checksums and signatures before use.
- Watch for providers that spawn shell scripts or reach unexpected domains.
- Block lookalike domains such as hashicorp-terraform[.]io at the network edge.
- Flag downloads of font files from GitHub or dynamic DNS hosts on build systems.
- Keep cloud credentials out of browsers and rotate them after any suspected compromise.
- Store crypto wallet keys on hardware wallets, not browser extensions.
In short, this trojanized Terraform provider shows how attackers now hide inside routine developer tooling. Treat every third-party plugin as code that can run with your privileges.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
