Potential TraderTraitor FLATROOF/ROOFDECK - Network C2 Indicators

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•2

Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.