Verify Terraform Provider Integrity After TraderTraitor Campaign Targets Devs
North Korean-linked actors used a trojanised Terraform provider in July 2026 to deploy FLATROOF and ROOFDECK malware across developer systems.
Key points
- The TraderTraitor group deployed a trojanised Terraform provider in July 2026 to infect developer environments.
- The attack delivers a Bash loader that selects operating-system-specific malware, including FLATROOF and ROOFDECK.
- Zscaler ThreatLabz links the campaign to North Korean actors, though attribution remains provisional according to GBHackers.
Zscaler ThreatLabz identified a sophisticated supply-chain attack in July 2026 involving a trojanised Terraform provider. The campaign, attributed to the North Korean-backed group TraderTraitor, targets cryptocurrency industry professionals and general developer environments. The threat actor used this infrastructure tool to deliver a multi-stage infection chain that bypasses standard security checks by embedding malicious code within a legitimate development utility.
How does the trojanised provider compromise systems?
The malicious provider executes its payload immediately when Terraform loads the component, preserving normal functionality to avoid detection. According to Zscaler ThreatLabz, the provider downloads a cross-platform Bash loader from a domain mimicking HashiCorp branding. This loader is designed to operate silently while maintaining the expected behaviour of the Terraform environment, allowing the attacker to establish an initial foothold without disrupting the victim's workflow or triggering immediate alerts based on application performance.
What malware families are deployed in this campaign?
The Bash loader selects and downloads specific payloads based on the victim's operating system and CPU architecture, supporting macOS, Linux, and Windows. The primary malware families observed are FLATROOF and ROOFDECK. FLATROOF deploys Python scripts to steal sensitive data and credentials from the victim's machine. Once initial access is secured and data is exfiltrated, the attack chain drops the ROOFDECK backdoor, which provides the attackers with full remote control over the compromised system for further operations.
How certain is the attribution to TraderTraitor?
Zscaler ThreatLabz links the campaign to TraderTraitor, also known as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces. The group has a history of targeting the cryptocurrency sector. However, GBHackers notes that the attribution remains provisional. While ThreatLabz found similarities in targeting, tooling, and tactics, the analysis lacked unique code matches, shared infrastructure, or cryptographic evidence to definitively prove the link. The campaign overlaps significantly with the previously reported KelpDAO incident, which also involved FLATROOF and ROOFDECK.
What technical evasion techniques are used?
The malware employs sophisticated methods to conceal its command-and-control (C2) communications. According to Zscaler ThreatLabz, the tools hide and retrieve the final C2 address to evade detection by security monitoring systems. The use of a HashiCorp-themed lookalike domain for the initial loader download further obfuscates the attack's origin. By leveraging a trusted infrastructure tool like Terraform, the attackers bypass many perimeter defences that might otherwise block unknown executables, relying on the victim's trust in the development platform to facilitate the compromise.
What to do and how to stay safe: Terraform
- Audit all Terraform providers and infrastructure-as-code dependencies for unexpected code or recent unauthorised changes.
- Monitor network traffic for connections to domains mimicking legitimate vendors like HashiCorp, especially from development workstations.
- Review system logs for the execution of Python scripts or Bash loaders that do not correspond to known development tasks.
- Implement strict integrity checks for development tools and restrict the ability to install new providers without administrative approval.
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which operating systems are affected by this Terraform provider attack?
The Bash loader delivers payloads tailored for macOS, Linux, and Windows systems based on the victim's architecture.
Is there a confirmed patch for this trojanised Terraform provider?
No fix has been confirmed yet; users should verify provider integrity and monitor for vendor updates.
What is the relationship between FLATROOF and ROOFDECK?
FLATROOF is used for initial credential theft and data exfiltration, while ROOFDECK is dropped later to provide remote control.
