Executive Summary
Analysis of Lazarus Group's TraderTraitor campaign reveals a significant OPSEC failure in their infrastructure deployment. The threat actor utilized the 'mkcert' utility to generate development TLS certificates, which inadvertently embedded local system metadata into the certificates served by public-facing command-and-control (C2) servers. This analysis successfully linked 13 unique IP addresses across multiple hosting providers by correlating shared Authority Key Identifiers (AKI), issuer names, and specific Subject OU labels.
The technical investigation identified three primary personas or systems used in the certificate generation process: 'halid' and 'yuli', linked to MSI Raider GE78 HX 14VIG gaming laptops, and 'ub', associated with a QEMU virtual machine environment. The infrastructure supports multiple backdoors including ROOFDECK and FLATROOF, which are known to target financial services and cryptocurrency entities via trojanized software like Terraform providers.
This activity is attributed to the DPRK-linked Lazarus Group (specifically UNC4899/TraderTraitor) with high confidence based on overlaps with reported KelpDAO incidents and other documented C2 nodes. The reuse of certificate metadata across diverse hosting providers—including Virtual Systems and ITL—suggests a centralized but poorly obfuscated infrastructure preparation process.