Reported by 4 outlets
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.29 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.4 / 10 = base × recency + community
Desk analysis
Zscaler ThreatLabz reports a suspected TraderTraitor (North Korean-linked APT, also tracked as Jade Sleet / UNC4899) campaign using a trojanized Terraform provider to deliver cross-platform malware. The provider downloads a Bash loader that selects payloads for macOS, Linux, or Windows based on OS and architecture. Two malware families are deployed: FLATROOF for credential theft, followed by ROOFDECK for remote control.
The targeting overlaps with the previously reported KalpDAO incident, and attribution remains provisional due to lack of unique code or cryptographic evidence. The use of a trojanized infrastructure-as-code provider indicates a focused effort against developer and DevOps environments rather than broad opportunistic distribution.
Organizations using Terraform should verify provider sources and checksums, restrict provider downloads to official HashiCorp registries, and audit for unexpected Bash loader execution in CI/CD pipelines. Watch for additional developer-tool trojanization campaigns tied to state-sponsored groups.
Timeline
-
original reporting
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
malware.news · 5d ago · October 8th, 2026
IntroductionIn July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. This campaign also significantly overlaps with the previously reported KalpDAO incident, the analysis of which discussed both FLATROOF and ROOFDECK, two malware families also observed in this campaign. The attackers utilized a trojanized Terraform provider to deliver a Bash loader that selects and downloads malware tailored to the victim’s operating system. The FLATROOF malware deployed Python scripts to steal sensitive data from the victim before ultimately dropping the ROOFDECK backdoor to gain full remote control.In this blog, ThreatLabz examines the inner workings of these tools and analyzes the multi-stage infection chain. We also explore how this sophisticated malware conceals and retrieves its final command-and-control (C2) address to evade detection. Key TakeawaysIn July 2026, ThreatLabz discovered a trojanized Terraform provider that executes malicious code as soon as Terraform loads the provider.The trojanized Terraform provider downloads a cross-platform Bash loader from a HashiCorp-themed lookalike domain while preserving normal Terraform behavior.The loader selects payloads for macOS, Linux, and Windows according to the operating system and CPU architecture.Encrypted execu
-
update from www.zscaler.com
(zscaler.com) Suspected TraderTraitor Group Exploits Trojanized Terraform Provider to Deploy Cross-Platform Malware FLATROOF and ROOFDECK In
www.zscaler.com · 5d ago · October 8th, 2026
(zscaler.com) Suspected TraderTraitor Group Exploits Trojanized Terraform Provider to Deploy Cross-Platform Malware FLATROOF and ROOFDECK In
via Mastodon https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver
-
update from gbhackers.com
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
gbhackers.com · 4d ago · October 9th, 2026
The operation delivers FLATROOF for credential theft and initial access, followed by ROOFDECK for broader remote control. Attribution remains provisional. ThreatLabz found similarities in targeting, tooling, and tactics but lacked unique code matches, shared infrastructure, or cryptographic evidence […] The post Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by securityonline.info
Suspected TraderTraitor hackers used a trojanized Terraform provider to drop FLATROOF and ROOFDECK malware on macOS, Linux, and Windows. # T
securityonline.info · 1d ago · October 12th, 2026