Executive Summary
The North Korean state-sponsored actor Jade Sleet, also known as TraderTraitor or UNC4899, has expanded its operations to include targeting IT services providers, specifically focusing on DevOps engineers. This campaign, previously linked to major cryptocurrency thefts such as the KelpDAO/LayerZero incident, utilizes sophisticated social engineering through fake job interviews and 'coding challenges' hosted on GitHub.
Technically, the actor delivers malware by weaponizing Terraform dependency lock files (.terraform.lock.hcl) that point to typosquatted malicious registries. When a victim runs 'terraform init', the environment downloads and executes malicious modules, ultimately deploying two Rust-based macOS backdoors: FLATROOF (macOS.Gaslight) and ROOFDECK. These backdoors leverage decentralized C2 protocols like Nostr and Telegram to evade detection while harvesting browser data, terminal history, and cloud credentials.
This shift in targeting highlights a significant threat to the software supply chain. Even organizations without direct cryptocurrency ties are at risk if their developers manage sensitive infrastructure, as the adversary seeks initial access to cloud environments (AWS/GCP) and source control for downstream exploitation.