X-Industry

Throughout 2026, the financially motivated, DPRK state-sponsored Lazarus subgroup TraderTraitor (aka UNC4899, PUKCHONG, Jade Sleet) has run campaigns targeting cryptocurrency trading entities, including a high-profile April attack in which the group stole USD 292 million from KelpDAO by compromising LayerZero.

KelpDAO is a decentralized finance (DeFi) protocol that supports Ethereum restaking; LayerZero Labs provides services that enable cryptocurrency exchange across different blockchain platforms.[1]

TraderTraitor compromised LayerZero Labs and determined methods to create a fake cryptocurrency minting event, which the attacker combined with a DDoS against validation servers so that compromised servers would approve an illegitimate mint event, leading to the massive theft.

After the public disclosure of this breach, SentinelOne identified an additional victim infected with the macOS backdoors FLATROOF (aka macOS.Gaslight) and ROOFDECK, first observed in the LayerZero Labs attack.

Unlike the previous high-profile victim, this target was a much smaller IT services organization. Our investigation revealed what happens when this threat actor compromises a smaller organization, which we believe ultimately yielded insufficient value to sustain the intrusion.

Weaponized Terraform Coding Projects

Each campaign in this wave of activity uses social engineering via fake job-interview lures, a traditional Contagious Interview approach common among DPRK actors. The attacker contacts job seekers from the company ultimately compromised; the GitHub profiles of each targeted job seeker we identified fall under DevOps or cryptocurrency/FinTech engineering projects.

The GitHub repository themes for coding project lures mirror infrastructure engineering projects related to the company the DPRK actors are posing as. By pivoting from the gtn-candidate-repo repository shared by LayerZero Labs in their incident report, we identified additional lures, which included references to the companies Northwind and Novacart.

It is unclear whether these were fabricated companies used by the threat actor or whether they posed as hiring teams from real companies with these names; one Northwind example describes it as an e-commerce company launching soon. Other repository names that we identified include:

• Northwind-IAC
• novacart-interview
• terraform-candidate-repo

Interview task from a GitHub repository containing a weaponized .terraform.lock.hcl file

The repositories contain a weaponized .terraform.lock.hcl file in the coding project with a custom provider that points to a domain controlled by the attacker. We identified three malicious provider domains across multiple repositories:

registry.hashicorp-aws[.]com

registry.hashicorp-aws[.]io

registry.hashicorp-terraform[.]io

When the victim runs Terraform with the weaponized lockfile, Terraform treats the custom provider as the source of truth, downloading and executing the malicious provider modules.

Developer awareness can create friction in this type of attack: in one repository, the candidate being interviewed added a note saying they removed a typosquatted provider from the project’s original lock file, which may suggest they thought the interviewer was testing their security awareness.

Weaponized .terraform.lock.hcl file using a typosquatted provider domain in the weaponized GitHub repository

According to the LayerZero Labs report, the attackers installed the FLATROOF and ROOFDECK macOS backdoors after an employee installed a weaponized interview coding project on their company workstation. TraderTraitor used the backdoors to collect API keys from the organization and to escalate privileges to expand into the victim’s Amazon Web Services and Google Cloud Platform environments.

Analysts lack insight into many subsequent infections stemming from the GitHub repositories they found.  SentinelOne identified an unrelated victim by hunting through our telemetry for the macOS backdoors observed in the LayerZero Labs attack.

Additional Victim / The Victim - The affected organization is an IT services provider based in India and unaffiliated with cryptocurrency. One endpoint was involved: an Apple Silicon MacBook belonging to a DevOps engineer. The engineer ran Terraform and Ansible against AWS, OVH, and OpenStack on most working days, and the machine held cloud credentials and source control access: much like LayerZero Labs’ “Developer1”. Individuals whose social media profiles advertise infrastructure or DevOps work are targets for this type of attack, and the value of the target is whatever their laptop can reach.

Infection Timeline - According to Sentinel’s telemetry on this host, both backdoors were on disk as far back as 18 March, so they could not prove how they were delivered.  They remained dormant until 29 March, when beaconing and host activity began.

The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace was opened.

macOS Malware

Analysts observed two malware families being deployed in the compromise, identical to the ones described in the LayerZero Labs attack, named FLATROOF and ROOFDECK (by LayerZero Labs and Mandiant). Both are ARM64 backdoors for macOS written in Rust.

FLATROOF – Also observed was the FLATROOF backdoor deployed under the name SystemUpdate to ~/Library/com.apple.iTunesCloud/SystemUpdate. It is likely intended for initial data collection from the victim machine and to deploy secondary payloads.

Immediately after starting, FLATROOF suppresses Gatekeeper by removing the com.apple.quarantine attribute from ROOFDECK and sets the executable bit on it; the second implant runs with no signature check and no user prompt.

xattr -rd com.apple.quarantine .../com.apple.internal.ck/iSync

chmod +x .../com.apple.internal.ck/iSync

A detailed analysis of FLATROOF (aka macOS.Gaslight) was published by SentinelLABS in June 2026. Here, we present a short summary of the backdoor’s capabilities as denoted by its supported C2 commands:

The backdoor also carries a data-harvesting Python module, used to gather the following data and exfiltrate them over Telegram using a built-in Telegram bot token:

• Chrome, Brave, Firefox, and Safari browser data
• Terminal command histories
• Installed application listings
• A running-process snapshot via ps aux
• System hardware and software profile via system_profiler
• A raw copy of keychain-db

ROOFDECK - ROOFDECK acts as a more sophisticated backdoor with broader reconnaissance and lateral movement capabilities. We observed it dropped under the name iSync to ~/Library/com.apple.internal.ck/iSync.

It is clear from the design of the implant that it is intended to be used as an additional deployment after initial foothold and control are established, since it needs a pre-existing configuration file containing at minimum a Nostr public key of an attacker-controlled profile to allow it to connect to its C2 server for the first time.

ROOFDECK uses a local configuration file ~/.config/.repl_history to store C2 URLs and keys and to set beaconing behavior.

Upon first execution, it pulls live Nostr relays from api. nostr[.]watch/v1/online and combines them with a hardcoded relay list belonging to legitimate Nostr services, then searches the relays for an operator’s profile on the Nostr network based on a public profile key given in the configuration file nostr_public_keys. When found, it reads the website field of the profile and uses that as its C2 URL. TraderTraitor has previously used Nostr.

The following is a list of Nostr relays used for operator profile discovery:

wss://relay.damus[.]io

wss://nos[.]lol

wss://nostr[.]mom

wss://relay.snort[.]social

wss://offchain[.]pub

wss://relay.nostr[.]band

wss://nostr.oxtr[.]dev

wss://nostr[.]wine

Persistence was achieved via a plist entry ~/Library/LaunchAgents/loginwindow.plist, with a dynamically specified application identifier string. It uses a hardcoded --type=renderer parameter to make the implant process appear legitimate.

Plist used for persistence, <IDENTIFIER> and <EXECUTABLE_PATH> are inserted at runtime

ROOFDECK supports a wide variety of C2 commands to manage the implant, perform reconnaissance, exfiltrate data, and execute attacker code. The C2 endpoint is hardcoded as /app_version. The implant polls for commands via HTTPS using a custom pinned TLS certificate embedded in the implant, shown below.

Interestingly, the malware author used default metadata settings with mkcert, which exposed that they are running on a Linux QEMU-based VM using the username ub. We identified multiple domains using a certificate containing this certificate CN (listed in the Indicators of Compromise section).

Subject = Issuer (self-signed):

    O  = mkcert development CA

    OU = ub@ub-Standard-PC-Q35-ICH9-2009

    CN = mkcert ub@ub-Standard-PC-Q35-ICH9-2009

Serial:    1CD6D13FF15ADBF7A42025D10EC99B4A

Key:       RSA 3072-bit

Validity:  2025-06-20 11:06:53 UTC -> 2035-06-20 11:06:53 UTC  (10-year mkcert default)

ROOFDECK signs commands with the operator’s private key and verifies their integrity using an embedded public key before execution. The source code separates command functionality into distinct handlers. The implant reimplements many common shell commands for directory and file operations, another tactic often used in more sophisticated North Korea-aligned toolsets, including Lazarus’ LightlessCan.

Session & Control

Execution

File system/data

Transfer

Reconnaissance / surveillance - All C2 commands are signed on the server side by an attacker-controlled private key. The public key is embedded in the ROOFDECK payload and is used to verify the origin and integrity of the issued commands before executing them.

-----BEGIN RSA PUBLIC KEY-----

MIIBCgKCAQEAzan/EObUVxXNfPHdkDyCVR0AC9apleciK9ZQw+neWo6q+wvAhnLp

Pe7FZLomuwntUgI3afLDblgw9t19Kh7w/8CVwFncxh4PdqtdYno4teQ6fDLKXSWa

ZBG7zZ9R22jxPpiY70XKilXJuds34q7pfzVfbLvLTmTWyTtcyrOnRSCOwEHP/gHX

0gX+8sdX7go6O37WwzB4zNvThS+E7hG+fVfrgEaH7IUi3RY9esuBS50UomfYefO3

dK1aDMDWIwVj1skacPR9LazEc6PSGjSXxzI/N2xcpP9QKXn/Pk6r9fBzudhBL3Mw

vWyNi03JbZGtGFiy6Wai6heJqgY7pF1PAQIDAQAB

-----END RSA PUBLIC KEY-----

Another version of ROOFDECK - On April 20, one day after LayerZero Labs’ first public announcement of the KelpDAO incident, the attackers deployed a new version of ROOFDECK to the compromised machine (SHA-1: 5728b11d30586bbfc1d8bd12df1c722a06e767a2, path ~/Library/com.apple.appleaccountd/loginwindow) as an executable named loginwindow. 

After the new version initialized and started beaconing, the attackers used it to remove the old ROOFDECK and FLATROOF binaries. This new ROOFDECK was functionally identical to the previous one but stripped of symbols and debug information, likely to evade detection more effectively. Researchers could only speculate whether this was a reaction to LayerZero Labs’ publication, but the timing is nevertheless interesting.

After the update, we observed intermittent beaconing activity to a new C2 server, grenight[.]com, until 1 June. On 17 June, we moved the loginwindow binary to Trash.

Conclusion - DPRK-aligned actors like TraderTraitor are increasingly targeting developers to establish a foothold in a network, often through fake job interviews. The incident we investigated shows that not every organization they infiltrate will become a viable target for a massive cryptocurrency theft.

These groups’ initial access efforts include targeting third parties and their software supply chain, where much of the industry’s exposure has shifted, putting the developer endpoint at the center of defense. Endpoints used for development carry access to cloud, pipelines and source code, which makes monitoring and protection a high priority for organizations. These campaigns use purpose-built development environments aimed at one engineer at a time, paired with backdoored Terraform builds that differ for each victim.

Recommendations - For organizations:

Sentinel Labs recommends flagging engineers with cloud engineering permissions and source control access as a sensitive group for endpoint security monitoring.

Look for unsigned binaries executing from the home directory, integrated development environment (IDE) child processes that are not signed IDE components, and outbound TLS from either.

Also follow up on reports of interview take-home assignments and unsolicited repositories from these users, since telemetry alone will not show that a recruiter sent one.

Consider company policy that prevents using corporate workstations for external job interviews, and how to enforce it.

Educating developers with sensitive access is crucial: one job seeker removed the weaponized Terraform provider domain after flagging the typosquatted domain as suspicious. Organizations should add content to their security awareness training programs to highlight the risks of using projects with unknown origins as well as the nature of employees being targeted by threat actors to compromise the organization.

For developers:

Before running a coding project containing a .terraform.lock.hcl file, ensure that the provider registry belongs to known good domains: anything that is not a known namespace following registry.terraform.io, the official provider domain, should be treated as suspect.

Malicious packages can also be hosted on the official provider registry domain, so it is important to investigate the source of all packages when using an included lockfile. Terraform’s official registry supports browsing modules and providers, and modules contain a link to its source code.

This Sentinel report was published alongside a presentation at LABScon 2026, Don’t Call Us, We’ll Call Your APIs: Anatomy of an Expanding DPRK Multi-Cloud Intrusion. SentinelOne thanks Google and Mandiant for partnering to provide technical details on this threat actor’s tools and techniques, and Nick Simonian for collaborating on this research.  Red Sky Alliance would also like to thank SentinelLabs for this research.

Indicators of Compromise / IoCs (additional victim)

Custom certificate used for TLS communication

Host IoCs – ROOFDECK

Network IoCs – ROOFDECK

Certificate Domains related to “ub” user

Coding Challenge Repositories

hashicorp-aws[.]com Provider:

hashicorp-aws[.]io Provider:

hashicorp-terraform[.]io Provider:

This article is shared at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization.  We provide indicators of compromise information (CTI) via a notification service (RedXray) or an analysis service (CTAC).  For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com    

Weekly Cyber Intelligence Briefings:

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929

[1] https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/