Jade Sleet/TraderTraitor FLATROOF & ROOFDECK IOC Hunt

Arnold Chan@slaz

•updated Sep 21, 2026•1•0•6

Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.