SlowMist says North Korea-linked TraderTraitor used a malicious Terraform project in a fresh attack

BlockBeats reported on Sept. 22 that, according to SlowMist, the North Korea-linked threat group TraderTraitor, also known as UNC4899 and Jade Sleet, has launched another attack and recently compromised an IT services company in India that was unrelated to the crypto industry.

Fake GitHub recruiting posts used as the lure

SlowMist said the attackers posted fake job listings on GitHub and used a so-called technical interview assignment to phish DevOps engineers and crypto engineers. After a target downloaded the project, a malicious .terraform.lock.hcl file pointed to a Terraform Provider domain controlled by the attackers.

Once the victim ran terraform init, the process triggered the download and execution of a malicious Provider module.

FLATROOF and ROOFDECK deployed on macOS

The attack ultimately deployed the Rust/ARM64 backdoors FLATROOF and ROOFDECK on the victim’s macOS device. SlowMist said both malware families had previously been used in the LayerZero attack.

According to the disclosure, the malware can:

• steal credentials and sensitive data;
• execute shell commands;
• collect and exfiltrate files;
• obtain access to cloud services and code repositories.

Targeting now extends beyond crypto

SlowMist warned that TraderTraitor’s targets in this campaign were no longer limited to the crypto sector. The attackers may be paying closer attention to developers’ cloud and API access, including AWS, GCP, OVH and OpenStack.

SlowMist advised companies to treat unfamiliar Terraform Providers and code repositories supplied by recruiters with caution, and to avoid running unverified interview projects on personal or corporate development devices.