Loading malware…
ROOFDECK is a Rust-based backdoor with macOS and Windows variants that provides extensive remote control of compromised systems. It is used as a follow-on implant after an initial foothold, frequently alongside the FLATROOF backdoor. North Korean threat actor TraderTraitor, also known as Jade Sleet and UNC4899, has deployed ROOFDECK in operations targeting cryptocurrency and Web3 organizations and an India-based IT services provider. Targeted personnel include developers and DevOps engineers with access to cloud infrastructure and source code.
ROOFDECK supports arbitrary command execution, interactive and reverse shells, host and process reconnaissance, disk and filesystem discovery, file manipulation, uploads and downloads, encrypted archive creation, clipboard reading and writing, and background-task management. It also supports persistence management, configuration changes, self-updating, and self-removal. macOS deployments establish persistence through LaunchAgents and masquerade as legitimate applications or processes. Operators have deployed stripped variants and removed earlier implants to reduce forensic evidence and hinder analysis. The backdoor supports post-exploitation activity, including data exfiltration and lateral movement.
A distinguishing feature is resilient command-and-control discovery. ROOFDECK can obtain server information from local configuration, cryptographically signed and encrypted Pastebin records, or Nostr profile metadata. It verifies signatures before accepting remotely retrieved server information and uses HTTP and WebSocket communications after resolving its server address. Observed macOS implants also verify signed operator commands using an embedded RSA public key.
Associated campaigns use recruitment-themed coding assessments and weaponized Terraform projects to induce execution of malicious providers. ROOFDECK is subsequently deployed to deepen access. Windows and macOS variants have also been identified alongside a trojanized Terraform-provider campaign involving FLATROOF.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control.
ROOFDECK, masquerading as iSync, offered broader control... The attackers later deployed a stripped ROOFDECK variant called loginwindow, removed the earlier implants, and continued beaconing through June 1.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
Each lure contained a manipulated .terraform.lock.hcl file that directed Terraform toward an attacker-controlled provider registry instead of a legitimate source. Running terraform init then downloaded and executed malicious provider modules.
“[They created] fake GitHub repositories with malicious Terraform dependency lock files. When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules.”
“TraderTraitor, employed social engineering tactics, using job interview lures to target individuals in DevOps, cryptocurrency, and financial technology roles.”
FLATROOF ... is capable of command execution ... ROOFDECK ... is capable of ... remote shell access.
FLATROOF... can run shell commands... ROOFDECK... can... execute commands.
“When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules.”
The malicious implants remained undetected until March 29, when they were triggered by the victim launching a workspace within the Cursor development environment.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
ROOFDECK ... facilitat[es] ... persistent access through the use of LaunchAgents.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
ROOFDECK ... facilitat[es] ... persistent access through the use of LaunchAgents.
The new ROOFDECK variant removed symbols and debug information to make detection more difficult.
The font-contained payload uses Base64 and AES-256-CBC.
FLATROOF implant ... has been dropped as SystemUpdate ... ROOFDECK, which was deployed as iSync utility.
The malware poses as a Terraform AWS provider and Safari updater.
The attackers later deployed a stripped ROOFDECK variant called loginwindow, removed the earlier implants, and continued beaconing through June 1.
TraderTraitor collected API keys and escalated privileges to expand into the victim's Amazon Web Services and Google Cloud Platform environments.
FLATROOF suppresses Gatekeeper by removing the com.apple.quarantine attribute from ROOFDECK and sets the executable bit on it; the second implant runs with no signature check and no user prompt.
TraderTraitor used the backdoors to collect API keys from the organization; ROOFDECK find searches for high-value data including wallets, keys, and documents.
The stealers enumerate running processes using ps aux or tasklist.
The loader identifies the operating system and CPU architecture to select a payload.
The stealers enumerate browser profiles and extension directories.
ROOFDECK... can search for valuable files... [and] transfer data.
ROOFDECK reads clipboard contents on Windows and macOS.
zip / unzip — Create/extract archives incl. AES-encrypted zips... Used to stage encrypted exfiltration bundles or unpack downloaded archives.
ROOFDECK... create[s] encrypted archives.
ROOFDECK supports fallback from its Pastebin resolver to Nostr.
“ROOFDECK, which uses the Nostr protocol for decentralized command and control.”
Malware uses HTTP or HTTPS for C2 communication.
FLATROOF... upload[s] files through Telegram... ROOFDECK... resolves command servers through the decentralized Nostr network.
ROOFDECK obtains the C2 server address through Pastebin and Nostr.
ROOFDECK retrieves live Nostr relays, locates an operator profile using a configured public key, and uses the profile website field as its C2 URL.
“When developers ran the ‘terraform init’ command, their systems downloaded attacker-controlled modules. This led to the deployment of two Rust-based macOS backdoors.”
ROOFDECK ... facilitat[es] ... file transfer exfiltration of data.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.