North Korea-linked hackers TraderTraitor launch new wave of attacks using malicious Terraform projects.

BlockBeats news, September 22 - According to SlowMist, the North Korea-linked threat group TraderTraitor (also known as UNC4899, Jade Sleet) has launched another attack, recently breaching an IT services company located in India that is unrelated to the crypto industry.

The attackers posted fake job listings on GitHub, using "technical interview assignments" as bait to launch phishing attacks targeting DevOps and crypto engineers. After victims download the relevant projects, a malicious .terraform.lock.hcl file points to a Terraform Provider domain controlled by the attackers. Running terraform init triggers the download and execution of a malicious Provider module.

The attack ultimately deploys the Rust/ARM64 backdoors FLATROOF and ROOFDECK on the victim's macOS device. These two malware families were previously used in the LayerZero attack. They possess capabilities including stealing credentials and sensitive data, executing shell commands, collecting and exfiltrating files, and gaining access to cloud services and code repositories.

SlowMist warns that TraderTraitor's attack targets are no longer limited to the crypto industry. The attackers may be more focused on the cloud and API access privileges held by developers, such as AWS, GCP, OVH, and OpenStack. Enterprises should be cautious when handling unfamiliar Terraform Providers and code repositories provided by recruiters, and should avoid using personal or company development devices to execute unverified interview projects.