Loading malware…
FLATROOF is a Rust-based backdoor family targeting macOS, Linux, and Windows, with macOS variants also tracked as Gaslight or macOS.Gaslight. It combines remote command execution and host-management functionality with platform-specific Python information stealers. FLATROOF has been used by the North Korean threat actor TraderTraitor, also known as Jade Sleet, in operations targeting cryptocurrency and Web3 organizations and an Indian IT services provider. Targeted personnel include developers and DevOps engineers with access to cloud credentials and source code.
Delivery chains use recruitment-themed coding assignments and weaponized Terraform projects that retrieve and execute malicious providers. A cross-platform chain uses a trojanized Terraform provider to launch a Bash loader, which selects architecture-specific payloads concealed within encrypted font-like files. FLATROOF supports shell-command execution, process termination, file management, payload downloads, data uploads, configuration changes, and self-removal. Command-and-control options include the Telegram Bot API, GitHub API polling, and attacker-controlled HTTP webhooks; channel availability varies by sample. Persistence mechanisms include Linux services, macOS shell-logout configuration, and Windows registry autorun entries.
Its Python components collect browser credentials, session cookies, browsing history, autofill information, command histories, installed-application inventories, process listings, and system information. Platform-specific targets include macOS keychain data, Linux keyrings, Windows Credential Manager entries, and cryptocurrency-wallet browser-extension data. A Windows component injects code into a suspended Chromium process to recover browser encryption keys. Collected information is archived for exfiltration. FLATROOF also performs initial collection and follow-on deployment of the ROOFDECK backdoor; observed macOS variants remove the secondary payload's quarantine attribute and grant executable permissions to facilitate execution.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control.
The operators used this access to install FLATROOF and ROOFDECK backdoors on macOS. FLATROOF was disguised as SystemUpdate and was designed for initial collection and follow-on delivery.
43 distinct techniques documented for this family, organized by ATT&CK tactic.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
Each lure contained a manipulated .terraform.lock.hcl file that directed Terraform toward an attacker-controlled provider registry instead of a legitimate source. Running terraform init then downloaded and executed malicious provider modules.
“[They created] fake GitHub repositories with malicious Terraform dependency lock files. When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules.”
“TraderTraitor, employed social engineering tactics, using job interview lures to target individuals in DevOps, cryptocurrency, and financial technology roles.”
FLATROOF ... is capable of command execution ... ROOFDECK ... is capable of ... remote shell access.
FLATROOF ... can be used to execute arbitrary shell commands.
FLATROOF can deploy and execute an embedded Python stealer.
“When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules.”
The malicious implants remained undetected until March 29, when they were triggered by the victim launching a workspace within the Cursor development environment.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
FLATROOF selects zlogout persistence on macOS.
The Windows stealer hollows Chrome, Brave, or Edge processes.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
FLATROOF selects zlogout persistence on macOS.
Executable content is embedded after the @ @ENDFONT @@ marker.
The font-contained payload uses Base64 and AES-256-CBC.
FLATROOF implant ... has been dropped as SystemUpdate ... ROOFDECK, which was deployed as iSync utility.
The malware poses as a Terraform AWS provider and Safari updater.
Encrypted executable payloads are distributed as .woff files.
The Windows stealer hollows Chrome, Brave, or Edge processes.
The attackers later deployed a stripped ROOFDECK variant called loginwindow, removed the earlier implants, and continued beaconing through June 1.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
On macOS, the loader removes the quarantine attribute before launching it.
The macOS loader applies an ad-hoc code signature.
The stealers collect browser cookie databases.
TraderTraitor used the backdoors to collect API keys from the organization; ROOFDECK find searches for high-value data including wallets, keys, and documents.
The stealers collect shell-history files.
The backdoor also carries a data-harvesting Python module... [to gather] Chrome, Brave, Firefox, and Safari browser data... [and] a raw copy of login.keychain-db.
The macOS stealer copies the keychain DB file.
[FLATROOF's] capabilities also include harvesting browser information.
The Windows stealer enumerates and reads Credential Manager entries.
The stealers enumerate running processes using ps aux or tasklist.
The loader identifies the operating system and CPU architecture to select a payload.
The stealers enumerate browser profiles and extension directories.
The Python stealers collect browser-related data.
The stealers enumerate installed applications.
FLATROOF checks paths and processes associated with Cortex XDR and Traps.
“FLATROOF ... can exfiltrate browser data and system information.”
The Windows stealer invokes PowerShell Compress-Archive.
ROOFDECK supports fallback from its Pastebin resolver to Nostr.
FLATROOF uses Telegram for command-and-control, while ROOFDECK uses the Nostr protocol for decentralized C2 communications.
Malware uses HTTP or HTTPS for C2 communication.
“FLATROOF, which uses Telegram for command and control.”
FLATROOF, a backdoor that uses Telegram for command-and-control (C2).
“When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules. This led to the deployment of two Rust-based macOS backdoors.”
FLATROOF uses an AES-encrypted C2 channel.
FLATROOF exfiltrates files and harvested data through Telegram; ROOFDECK upload exfiltrates local files to its C2.
FLATROOF... can... upload files through Telegram.
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.