Full Report
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
Analysis Summary
# Threat Actor: TraderTraitor
## Attribution & Identity
* **Actor identification:** TraderTraitor is a financially motivated Lazarus subgroup attributed to the Democratic People’s Republic of Korea (DPRK).
* **Aliases:** UNC4899, PUKCHONG, Jade Sleet.
* **Known Associations:** Part of the broader Lazarus Group ecosystem (state-sponsored DPRK).
## Activity Summary
* **2026 Campaigns:** Recent operations involve the "Contagious Interview" scheme, targeting DevOps and infrastructure engineers via social engineering on platforms like GitHub.
* **LayerZero/KelpDAO Breach:** A high-profile April 2026 attack where the actor stole USD 292 million through a compromise of LayerZero, involving a fake cryptocurrency minting event and DDoS attacks against validation servers.
* **IT Services Intrusion:** Discovery of a second victim in the IT services sector (non-crypto related) infected with the same macOS backdoors (FLATROOF/ROOFDECK), indicating expanded targeting beyond DeFi.
## Tactics, Techniques & Procedures
* **Social Engineering:** Posing as hiring teams from companies (e.g., "Northwind," "Novacart") to lure candidates into performing technical assessments.
* **Supply Chain / Dependency Confusion:** Using weaponized Terraform coding projects. The actor places a malicious `.terraform.lock.hcl` file in a repository that points to an attacker-controlled custom provider registry.
* **Execution via Development Tools:** When a victim runs `terraform init`, the tool downloads and executes malicious provider modules from the attacker's domain.
* **Multi-Stage Malware Delivery:** Deploying macOS-specific backdoors following the initial compromise of the developer's environment.
* **Network Disruption:** Use of DDoS attacks to facilitate illegitimate blockchain transactions (as seen in the KelpDAO incident).
## Targeting
* **Sectors:** Cryptocurrency trading, Decentralized Finance (DeFi), IT Services, and Software Development (specifically DevOps).
* **Geography:** Global (targeting remote job seekers and international tech firms).
* **Victims:** LayerZero, KelpDAO, and an undisclosed IT services organization.
## Tools & Infrastructure
* **Malware Families:**
* **FLATROOF** (aka macOS.Gaslight) - A Rust-based backdoor.
* **ROOFDECK** - A macOS backdoor.
* **Weaponized Repositories (GitHub):**
* `gtn-candidate-repo`
* `Northwind-IAC`
* `novacart-interview`
* `terraform-candidate-repo`
* **Infrastructure (Defanged):**
* registry.hashicorp-aws[.]com
* registry.hashicorp-aws[.]io
* registry.hashicorp-terraform[.]io
## Implications
* **Shift in Targeting:** While primarily focused on cryptocurrency theft, the actor is willing to compromise non-crypto entities (IT services) likely to gain a foothold in broader supply chains or to scout for high-value targets.
* **Tooling Sophistication:** The exploitation of the Terraform provider ecosystem demonstrates a high level of technical proficiency in targeting modern DevOps workflows.
* **Persistence:** The reuse of the FLATROOF/ROOFDECK backdoors across different sectors suggests these tools remain effective for their objectives.
## Mitigations
* **Code Review:** Thoroughly audit technical interview assignments and third-party repositories before running commands like `terraform init` or `npm install`.
* **Dependency Verification:** Explicitly check `.terraform.lock.hcl` files for typosquatted or unauthorized provider registries.
* **Environment Isolation:** Conduct technical assessments and interview tasks in isolated, non-persistent virtual machines or sandboxes that do not have access to corporate credentials or production environments.
* **Endpoint Security:** Deploy robust EDR solutions capable of detecting macOS-specific malware and unauthorized process execution from development tools.