Reported by 2 outlets
TraderTraitor macOS Backdoors Found on Non-Crypto Victim
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
SentinelOne expanded its TraderTraitor (DPRK Lazarus subgroup) analysis beyond the April 2026 LayerZero cryptocurrency theft (USD 292 million) to an additional IT-sector victim showing the same macOS backdoors. The original report (mf:164271) details weaponized Terraform provider registries and custom GitHub repositories used in social engineering campaigns targeting job seekers. The update event (masto:117346022458332399) is a securityonline.info repost of the SentinelOne finding; since it names SentinelOne as the researcher source, it reinforces the primary reporting but does not add new verified claims.
No CVEs are named. The story score is 3.6, reflecting moderate severity but limited new incident scale compared to the original LayerZero breach. Defenders in IT services should watch for weaponized Terraform files and macOS backdoor delivery via fake job-offer repositories; review the SentinelOne analysis for IOCs and detection logic.
Timeline
-
original reporting
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
malware.news · 25d ago · September 18th, 2026
Executive Summary Following disclosure of the TraderTraitor attack against LayerZero in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a victim in the IT services sector with no relationship to cryptocurrency trading. We also identified more weaponized GitHub repositories from the social engineering schemes used to target job seekers in these campaigns. This report expands on how Terraform lock files enable the delivery of malware from custom Terraform provider registries controlled by the attackers. Overview Throughout 2026, the financially motivated DPRK state-sponsored Lazarus subgroup TraderTraitor ( aka UNC4899, PUKCHONG, Jade Sleet) has engaged in campaigns targeting entities involved in cryptocurrency trading, including a high-profile attack disclosed in April where USD 292 million was stolen from KelpDAO through a compromise of LayerZero . KelpDAO is a decentralized finance (DeFi) protocol that supports restaking Ethereum; LayerZero provides services with the capability to exchange cryptocurrency across different blockchain platforms. TraderTraitor compromised LayerZ
-
update from securityonline.info
SentinelOne discovered how new TraderTraitor macOS backdoors hit IT firms. Learn how TraderTraitor macOS backdoors use weaponized Terraform
securityonline.info · 16d ago · September 28th, 2026
SentinelOne discovered how new TraderTraitor macOS backdoors hit IT firms. Learn how TraderTraitor macOS backdoors use weaponized Terraform
via Mastodon https://securityonline.info/tradertraitor-macos-backdoors/?utm_source=mastodon&utm_medium=jetpack_social