MalwareUsed by 1 actor

FLATROOF

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TraderTraitor

SentinelOne identified an additional victim infected with the macOS backdoors, FLATROOF (aka macOS.Gaslight) and ROOFDECK, which were first observed in the LayerZero attack.

via sentinelone labssentinelone.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

T1195.002Compromise Software Supply ChainEvidence2

The repositories contain a weaponized .terraform.lock.hcl file with a custom provider pointing to an attacker-controlled domain.

Execution

2 techniques

T1059.004Unix ShellEvidence2

FLATROOF... shell: Execute a shell command via execvp... ROOFDECK: run <command>... spawns an arbitrary program... shell: Interactive shell via a PTY... rssh: Reverse shell.

T1204.002Malicious FileEvidence2

When the victim runs terraform init with the weaponized lockfile in place, Terraform downloads and executes the malicious provider modules.

Persistence

1 technique

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Stealth

4 techniques

T1036MasqueradingEvidence1

FLATROOF was deployed as SystemUpdate; ROOFDECK was deployed as iSync and later loginwindow, with a hardcoded --type=renderer parameter to appear legitimate.

T1036.005Match Legitimate Resource Name or LocationEvidence1

FLATROOF [was] deployed under the name SystemUpdate to ~/Library/com.apple.iTunesCloud/SystemUpdate... ROOFDECK [was] dropped under the name iSync to ~/Library/com.apple.internal.ck/iSync... [and] uses a hardcoded --type=renderer parameter to make the implant process appear legitimate.

T1070.004File DeletionEvidence2

After the new ROOFDECK version began beaconing, attackers used it to remove the old ROOFDECK and FLATROOF binaries; the timeline records rm -f of both original implants.

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence2

FLATROOF suppresses Gatekeeper by removing the com.apple.quarantine attribute from ROOFDECK and sets the executable bit on it.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

TraderTraitor used the backdoors to collect API keys from the organization; ROOFDECK find searches for high-value data including wallets, keys, and documents.

T1555Credentials from Password StoresEvidence2

The backdoor also carries a data-harvesting Python module... [to gather] Chrome, Brave, Firefox, and Safari browser data... [and] a raw copy of login.keychain-db.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

FLATROOF obtains a running-process snapshot via ps aux; ROOFDECK implements process listing through proc_listallpids, proc_pidinfo, and proc_pid_rusage.

T1082System Information DiscoveryEvidence2

FLATROOF [collects] installed application listings, a running-process snapshot via ps aux, [and] system hardware and software profile via system_profiler. ROOFDECK info [collects] OS/version, hostname/user, hardware IDs, geo-IP.

Collection

1 technique

T1005Data from Local SystemEvidence1

TraderTraitor used the backdoors to collect API keys from the organization... ROOFDECK find [performs] recursive file search... used to locate high-value data (wallets, keys, docs) for exfiltration.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

ROOFDECK polls for commands over HTTPS at /app_version and supports HTTP or WebSocket transport; FLATROOF and ROOFDECK beacon to attacker C2 infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

FLATROOF exfiltrates files and harvested data through Telegram; ROOFDECK upload exfiltrates local files to its C2.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

8 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 18, 2026

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties - Malware Analysis - Malware Analysis, News and Indicators

A macOS ARM64 backdoor that executes shell commands, terminates processes, uploads files via Telegram, collects browser data, terminal histories, installed applications, process information, system profiles, and login.keychain-db, and assists deployment of ROOFDECK.

sentinelone labsNews

Sep 18, 2026

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

An ARM64 Rust macOS backdoor used for initial host data collection and secondary-payload deployment. It removes ROOFDECK's quarantine attribute and makes it executable to bypass Gatekeeper protections. FLATROOF supports shell-command execution, process termination, file upload via Telegram, and host identification. Its embedded Python harvester collects browser data, terminal histories, installed applications, process and system profiles, and login.keychain-db.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

FLATROOF

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TraderTraitor

SentinelOne identified an additional victim infected with the macOS backdoors, FLATROOF (aka macOS.Gaslight) and ROOFDECK, which were first observed in the LayerZero attack.

via sentinelone labssentinelone.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

T1195.002Compromise Software Supply ChainEvidence2

The repositories contain a weaponized .terraform.lock.hcl file with a custom provider pointing to an attacker-controlled domain.

Execution

2 techniques

T1059.004Unix ShellEvidence2

FLATROOF... shell: Execute a shell command via execvp... ROOFDECK: run <command>... spawns an arbitrary program... shell: Interactive shell via a PTY... rssh: Reverse shell.

T1204.002Malicious FileEvidence2

When the victim runs terraform init with the weaponized lockfile in place, Terraform downloads and executes the malicious provider modules.

Persistence

1 technique

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Privilege Escalation

1 technique

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Stealth

4 techniques

T1036MasqueradingEvidence1

FLATROOF was deployed as SystemUpdate; ROOFDECK was deployed as iSync and later loginwindow, with a hardcoded --type=renderer parameter to appear legitimate.

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1070.004File DeletionEvidence2

After the new ROOFDECK version began beaconing, attackers used it to remove the old ROOFDECK and FLATROOF binaries; the timeline records rm -f of both original implants.

T1078.004Cloud AccountsEvidence1

TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence2

FLATROOF suppresses Gatekeeper by removing the com.apple.quarantine attribute from ROOFDECK and sets the executable bit on it.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence1

TraderTraitor used the backdoors to collect API keys from the organization; ROOFDECK find searches for high-value data including wallets, keys, and documents.

T1555Credentials from Password StoresEvidence2

The backdoor also carries a data-harvesting Python module... [to gather] Chrome, Brave, Firefox, and Safari browser data... [and] a raw copy of login.keychain-db.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

FLATROOF obtains a running-process snapshot via ps aux; ROOFDECK implements process listing through proc_listallpids, proc_pidinfo, and proc_pid_rusage.

T1082System Information DiscoveryEvidence2

Collection

1 technique

T1005Data from Local SystemEvidence1

TraderTraitor used the backdoors to collect API keys from the organization... ROOFDECK find [performs] recursive file search... used to locate high-value data (wallets, keys, docs) for exfiltration.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

ROOFDECK polls for commands over HTTPS at /app_version and supports HTTP or WebSocket transport; FLATROOF and ROOFDECK beacon to attacker C2 infrastructure.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

FLATROOF exfiltrates files and harvested data through Telegram; ROOFDECK upload exfiltrates local files to its C2.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

8 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 18, 2026

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties - Malware Analysis - Malware Analysis, News and Indicators

sentinelone labsNews

Sep 18, 2026

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.