Trojanized Terraform Providers Deliver Cross-Platform TraderTraitor Malware

In July 2026, threat researchers discovered a campaign attributed to the North Korean-backed group TraderTraitor (also known as Jade Sleet or UNC4899) targeting cryptocurrency and Web3 developers. The attackers utilized a trojanized Go-based Terraform provider, masquerading as a legitimate AWS plugin, to initiate a multi-stage infection chain. This delivery mechanism is particularly effective against DevOps environments and CI/CD systems, where provider binaries are routinely executed.

The attack involves a cross-platform Bash loader that downloads secondary payloads disguised as font files (.woff). These payloads include FLATROOF, a Rust-based backdoor capable of stealing browser credentials and crypto wallet data, and ROOFDECK, a sophisticated backdoor featuring resilient C2 discovery via Pastebin and Nostr metadata. This campaign demonstrates the adversary's evolving tradecraft in targeting developer supply chains and utilizing decentralized protocols for infrastructure resilience.

The business impact is significant for the financial and technology sectors, specifically targeting high-value cryptocurrency environments. The ability of the malware to compromise macOS, Linux, and Windows systems while bypassing Gatekeeper and other trust controls necessitates urgent verification of development tool integrity.