Reported by 2 outlets
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
gbhackers.com · 22d ago · September 21st, 2026
North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign […] The post Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
North Korean ROOFDECK Backdoor Uses Nostr Profiles to Hide Malware C2 Servers
cyberpress.org · 22d ago · September 21st, 2026
SentinelOne found that the attackers used two Rust-based macOS backdoors, named FLATROOF and ROOFDECK, previously linked to the April 2026 LayerZero compromise. In that incident, attackers allegedly stole $292 million from KelpDAO after compromising infrastructure connected to LayerZero. The newly identified victim was not involved in cryptocurrency. Instead, it was an IT services organization where a DevOps engineer used an Apple Silicon MacBook for Terraform, Ansible, AWS, OVH, and OpenStack administration. This highlights how attackers may target developers for the cloud credentials, source-code access, and infrastructure permissions available on their systems. ROOFDECK Uses Nostr C2 TraderTraitor used a known North Korean social-engineering method called Contagious Interview. Attackers contacted job seekers, mainly DevOps and FinTech engineers, and sent them GitHub repositories disguised as coding assignments. The repositories included names such as Northwind-IAC, novacart-interview, and terraform-candidate-repo. They contained a malicious .terraform.lock.hcl file pointing to typosquatted Terraform provider domains controlled by the attackers.