TraderTraitor — FLATROOF / ROOFDECK macOS Backdoors via Weaponized Terraform Lock Files

TraderTraitor, the DPRK state-sponsored Lazarus subgroup also tracked as UNC4899, PUKCHONG, Jade Sleet, and Slow Pisces, continues its Contagious-Interview playbook of posing as recruiters and hiring managers on GitHub to get developers to run attacker-controlled code. The objective is not the developer's laptop for its own sake — it is what the laptop can reach: cloud credentials, source control, and CI/CD pipelines. SentinelOne's 2026-09-18 report shows the group has moved beyond direct cryptocurrency targets (the USD 292M KelpDAO/LayerZero theft in April 2026) to a small IT-services shop with no crypto exposure at all, confirming this is now a general-purpose developer-endpoint intrusion vector, not a crypto-only campaign.

The technique that matters most defensively is the weaponized .terraform.lock.hcl file: victims clone a fake "technical assessment" repository, run terraform init, and Terraform silently downloads and executes a malicious provider binary from an attacker-controlled registry (registry.hashicorp-aws[.]com and lookalikes). This is the earliest, highest-fidelity, and most preventable point in the entire chain — before either backdoor (FLATROOF or ROOFDECK) ever touches disk. Everything downstream (Gatekeeper bypass, LaunchAgent persistence, Telegram/Nostr C2, credential theft, cloud-key abuse) is harder to catch cleanly and easier for the attacker to vary between victims.

ROOFDECK's C2 resolution is architecturally novel: instead of a hardcoded C2 address, it queries public Nostr relays for an attacker-controlled profile and reads that profile's website field as its live C2 URL — a dead-drop resolver built entirely on decentralized, difficult-to-take-down infrastructure that a defender cannot simply sinkhole.

Prompt-injection check: all four fetched sources were reviewed for embedded instructions directed at an automated reader. None were found — every match for imperative-sounding phrasing (e.g. "override") was legitimate technical prose describing the malware's own config-override behavior, not an attempt to redirect this pipeline. No content from any source was treated as an instruction.

Confidence assessment: Overall confidence is high — this is a vendor-named, three-researcher-credited report picked up by three outlets within 72 hours of publication. Those three outlets are derivative coverage of the same SentinelLABS analysis, not independent observation — so this campaign effectively rests on one first-party source, and no indicator in this pack clears the two-independent-source bar for a prevent action. Gaps: the ROOFDECK staging IP, two of three C2 IPs, the Nostr relay list, the TLS certificate details, and the exact on-disk binary/config paths appear in the SentinelOne report alone — those ship as hunt/enrich. Everything else ships as detect; nothing ships as prevent. Perishability: C2 IPs and domains for a publicly burned campaign are typically rotated within weeks of disclosure (this report published 2026-09-18); treat network IOCs as high-confidence for roughly 90 days from that date, not indefinitely.

Hunt Hypotheses (ordered by fidelity)

1. H1 (high): Developer endpoints resolve DNS for attacker-registered Terraform provider registries before any backdoor lands — the earliest network-visible step. Covered by Q1.
2. H2 (high): FLATROOF/ROOFDECK execute from non-standard, fake Apple framework-support paths that no legitimate process uses. Covered by Q2 / Q5.
3. H3 (high): Persistence is installed as a LaunchAgent whose spawned process masquerades as a Chrome renderer (--type=renderer) but is parented directly by launchd, which a real browser renderer never is. Covered by Q3.
4. H4 (high): Confirmed C2 infrastructure (IPs/domains) receives outbound connections from developer endpoints. Covered by Q4.
5. H5 (high): A new executable is written to one of the three fake Apple support paths before first execution. Covered by Q5.
6. H6 (high/medium FP): Gatekeeper's quarantine attribute is programmatically stripped via xattr immediately ahead of execution. Covered by Q6.
7. H7 (medium): A host process resolves public Nostr relay infrastructure — ROOFDECK's dead-drop C2 lookup mechanism. Covered by Q7.
8. H8 (medium, investigate-only): terraform init executes inside a workspace whose naming matches the interview/candidate-assessment lure pattern. Covered by Q8.

Attack Chain

These checks require no CQL and can be run directly on a suspect endpoint (via Falcon RTR) or against a repository / CI pipeline. They cover artifacts the CQL section either cannot reach (filesystem contents, repo diffs) or should be corroborated with before triage.

1. ROOFDECK config file: ls -la "$HOME/.config/.repl_history" — inspect contents for Nostr public keys / relay URLs / C2 hints. This path has no legitimate shell-history purpose.
2. ROOFDECK IPC pipe: ls -la /private/tmp/.pipe-airway — should not exist on a clean host; a named pipe here is a strong artifact.
3. FLATROOF lock file: ls $TMPDIR/tmp*.lock — review any match for owning process and creation time correlated against Q2/Q5 hits.
4. LaunchAgent renderer-masquerade sweep: for f in ~/Library/LaunchAgents/com.*.plist; do plutil -p "$f" 2>/dev/null | grep -q -- '--type=renderer' && echo "SUSPECT: $f"; done
5. Gatekeeper/quarantine unified-log review: log show --predicate 'eventMessage contains "quarantine"' --last 30d — cross-reference removals against Q6 process hits.
6. Fake Apple bundle-ID sweep: log show --predicate 'process contains "SystemUpdate" or process contains "iSync" or process contains "loginwindow"' --last 30d
7. Terraform lock-file provenance review (pre-merge, in CI or local): grep -R "hashicorp-aws\|hashicorp-terraform" **/.terraform.lock.hcl — any hit outside registry.terraform.io is a blocker, not a warning.

None of these seven checks require a Falcon macOS sensor and all seven are safe to run against a suspected-clean host as a baseline before rolling detections to prevent mode.

Custom IOA Candidates

Queries Q1, Q2, Q3, Q4, Q5, and Q6 are high-confidence, low-to-medium-FP behaviors with no legitimate business use on a compromised host and are recommended for promotion to Falcon Custom IOA rules once the Validation Gates in Section 11 are satisfied. Q7 and Q8 remain investigate-only (medium confidence, broader legitimate-use surface).

Alert & Triage Quick-Reference

Shared triage checklist for any Q1–Q6 hit (alert subject pattern: [CRITICAL] Detection: TraderTraitor -- <behavior> for Q1/Q2/Q3/Q4/Q5, [HIGH] for Q6):

1. Confirm the endpoint is macOS and record aid / ComputerName / UserName from the hit.
2. Pull the live process tree via Falcon RTR (ps aux, launchctl list) for the flagged PID/plist entry.
3. Run Q2, Q5, and Q6 scoped to the same aid to establish full compromise scope (see Pivot A below).
4. Hash any binary found at the three fake Apple support paths and compare against the Section 4 IOC table.
5. Enumerate ~/Library/LaunchAgents/*.plist for --type=renderer masquerade entries — preserve, do not delete, for forensics.
6. If confirmed, network-contain the host via Falcon RTR and proceed to the Containment Runbook (Section 14).
7. Rotate any AWS/OVH/OpenStack/GitHub credentials reachable from the endpoint.
8. Escalate to IR lead with the Hunt Summary Ticket (Section 16) populated.

Pivot Queries

Pivot A — host-scoped timeline

// PIVOT (host-scoped): full process/network/DNS timeline for one endpoint after a Q1-Q8 hit
// MITRE: n/a -- investigation pivot
// CONF: n/a  FP: n/a  COST: medium
// REQUIRES: ProcessRollup2, DnsRequest, NetworkConnectIP4
// LOOKBACK: 30d -- narrow to the incident window once the timeline is confirmed
// NOTE: replace REPLACE_WITH_AID with the aid value from the triggering hit before running
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|DnsRequest|NetworkConnectIP4/
| aid=REPLACE_WITH_AID
| table([@timestamp, #event_simpleName, ImageFileName, ParentBaseFileName, CommandLine, DomainName, RemoteAddressIP4])
| sort(@timestamp, order=asc)

Pivot B — environment-wide blast radius

// PIVOT (environment-wide): blast-radius count across all Q1/Q2/Q4/Q6 indicators, grouped by host
// MITRE: n/a -- investigation pivot
// CONF: n/a  FP: n/a  COST: medium
// REQUIRES: ProcessRollup2, DnsRequest, NetworkConnectIP4
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|DnsRequest|NetworkConnectIP4/
| (FileName=/^(SystemUpdate|iSync|loginwindow|xattr)$/i) or (RemoteAddressIP4=/^(176\.97\.114\.232|45\.11\.59\.140|85\.137\.56\.245|85\.137\.56\.10)$/) or (DomainName=/^(registry\.hashicorp-aws\.(com|io)|registry\.hashicorp-terraform\.io|technicais\.sytes\.net|storage\.hubpage\.cloud|grenight\.com)$/i)
| groupBy([ComputerName, aid], function=count(as=Hits), limit=1000)
| sort(Hits, order=desc, limit=200)

These four gates fold forward into the Detection Coverage Map (Section 15).

Playbook 1 — Terraform provider registry allowlist

# Playbook 1 -- Terraform provider registry allowlist (local + CI)
# Prerequisites: Terraform >=1.7 CLI; write access to the repo's versions.tf / .terraformrc
# Reboot required: no
# Rollback: remove the provider_installation block from .terraformrc / CLI config; re-run `terraform init` to
#           restore default registry resolution (no state is modified by this control)

cat >> ~/.terraformrc <<'EOF'
provider_installation {
  network_mirror {
    url = "https://registry.terraform.io/"
    include = ["*/*"]
  }
  direct {
    exclude = ["registry.hashicorp-aws.com/*", "registry.hashicorp-aws.io/*", "registry.hashicorp-terraform.io/*"]
  }
}
EOF

# CI gate (example, add to your pipeline before `terraform init`):
grep -R "registry.hashicorp-aws\|registry.hashicorp-terraform" **/.terraform.lock.hcl && exit 1 || true

Playbook 2 — Enforce Gatekeeper via MDM

# Playbook 2 -- Enforce Gatekeeper via MDM configuration profile (macOS)
# Prerequisites: MDM enrollment (Jamf/Kandji/Mosyle/etc.) with custom payload push capability
# Reboot required: no (profile applies on install; a logout is recommended but not required)
# Rollback: remove the configuration profile via MDM; spctl --master-enable restores interactive Gatekeeper
#           control to the local admin if the profile is withdrawn

# Verify current state before pushing the profile:
spctl --status
# expected: "assessments enabled"

# MDM custom payload (com.apple.systempolicy.control), key fields:
#   AllowIdentifiedDevelopers : false
#   EnableAssessment          : true
# Push via your MDM's custom payload / profile mechanism -- syntax is MDM-vendor specific.

# Post-deploy verification on the endpoint:
spctl --status && echo "Gatekeeper: OK" || echo "Gatekeeper: NEEDS REMEDIATION"

Playbook 3 — GitHub branch protection for lock-file changes

# Playbook 3 -- GitHub branch protection for Terraform lock-file changes
# Prerequisites: gh CLI authenticated with repo admin scope
# Reboot required: no
# Rollback: gh api -X DELETE repos/:owner/:repo/branches/:branch/protection

gh api -X PUT repos/:owner/:repo/branches/main/protection \
  -F required_pull_request_reviews.required_approving_review_count=1 \
  -F required_status_checks.strict=true \
  -F enforce_admins=true \
  -F required_linear_history=true

# Confirm:
gh api repos/:owner/:repo/branches/main/protection

Playbook 4 — Rotate static cloud credentials

# Playbook 4 -- Rotate static cloud credentials for a compromised/at-risk developer principal
# Prerequisites: IAM admin access; inventory of the affected principal's access keys
# Reboot required: no
# Rollback: none required -- credential rotation is one-directional by design; if the NEW key breaks an
#           automation, issue a fresh key rather than reinstating the rotated-out one

aws iam list-access-keys --user-name REPLACE_WITH_USERNAME
aws iam update-access-key --access-key-id REPLACE_WITH_KEY_ID --status Inactive --user-name REPLACE_WITH_USERNAME
aws iam create-access-key --user-name REPLACE_WITH_USERNAME
# Validate the new key works, then after a burn-in window:
aws iam delete-access-key --access-key-id REPLACE_WITH_KEY_ID --user-name REPLACE_WITH_USERNAME

Validation gates (Section 11) apply to every row marked as an IOA candidate above: none of them move to Prevent until the 30-day benign baseline and positive-test gates are satisfied.