Loading story…
North Korean threat actor Jade Sleet compromised an India-based IT services provider after targeting a DevOps engineer’s Apple Silicon MacBook with job-interview and infrastructure-engineering repository lures. The repositories contained weaponized Terraform lock files that fetched attacker-controlled modules during Terraform initialization. Malware was present by March 18, 2026, activated after the victim opened a Cursor workspace on March 29, and the ROOFDECK implant received anti-analysis updates on April 20.
The intrusion deployed the Rust-based macOS backdoors FLATROOF and ROOFDECK, enabling reconnaissance, persistence, remote command execution, data theft, lateral movement, and remote access. Their use against an organization without apparent cryptocurrency ties indicates that the TraderTraitor activity cluster is extending beyond its established crypto-sector targeting; Lazarus-linked operators have previously been attributed to the theft of more than $1.4 billion from Bybit through compromise of the Safe{Wallet} transaction-approval workflow.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
An updated ROOFDECK variant was deployed on the Indian DevOps engineer's system. It removed existing ROOFDECK and FLATROOF binaries and stripped symbols and debug information to impede detection and analysis.
LayerZero publicly acknowledged the KelpDAO hack, according to evidence tying the timing to the subsequent deployment of an updated ROOFDECK variant.
The implants began beaconing and conducting host activity after Cursor opened the cloudshield workspace in the engineer's DevOps-Automation directory. The backdoors had remained dormant until this activation.
FLATROOF and ROOFDECK were present on an Apple Silicon MacBook used by a DevOps engineer at an India-based IT services provider. The initial delivery mechanism was not identified.
Jade Sleet used the FLATROOF and ROOFDECK macOS backdoors during the attack on KelpDAO's LayerZero bridge. The activity occurred across March and April 2026.
Attackers stole more than $1.4 billion, including 401,347 ETH, from Bybit's cold wallet after manipulating the Safe{Wallet} transaction-approval workflow. Forensic investigation found malicious JavaScript injected through a compromised Safe{Wallet} developer machine; the operation was linked to the Lazarus Group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebsky.app
Open sourcenccgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international advisory from Australian, German, Japanese, and US agencies says the North Korea-linked **WaterPlum** campaign has infected more than 30,000 devices, compromised over 7,000 cryptocurrency wallets, and stolen at least $10.71 million. Operators posing as recruiters target engineers, web designers, and cryptocurrency/Web3 professionals with fraudulent interviews and coding assignments that deploy backdoors, remote-access trojans, and information stealers. Stolen credentials and identity data can support cryptocurrency theft, espionage, extortion, corporate intrusion, and fraudulent North Korean IT-worker activity. SentinelOne separately found DPRK-aligned **TraderTraitor** expanding the same job-lure tradecraft beyond cryptocurrency targets, compromising an Indian IT services provider through a weaponized Terraform repository. A typosquatted provider registry referenced in `.terraform.lock.hcl` enabled malicious modules to execute when a DevOps engineer ran Terraform; the engineer's Apple Silicon MacBook was subsequently infected with the **FLATROOF** and **ROOFDECK** macOS backdoors. The implants enabled credential theft, persistent remote command execution, reconnaissance, file transfer, and lateral movement, underscoring that developer endpoints with cloud, source-control, and CI/CD access are high-value targets regardless of their employer's industry.
Sep 20, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
North Korea-linked **Lazarus Group**, including the **TraderTraitor** cluster, targeted cryptocurrency exchanges, blockchain firms, and developers with social-engineering lures that delivered trojanized Python projects, fake code-evaluation repositories, malicious open-source packages, and compromised applications. Reporting tied the activity to campaigns that tricked victims into running files such as `StockInvestSimulator-main.zip` and `MonteCarloStockInvestSimulator-main.zip`, abusing unsafe `PyYAML` deserialization for remote code execution, while newer intrusion chains used heavily obfuscated Python and a six-stage flow that added **TSUNAMI/TSUNAMIKit** tooling beyond Lazarus’s previously observed Python-based payloads. Once inside, the attackers backdoored systems, stole credentials, SSH keys, browser wallet data, cloud credentials, and AWS session tokens, then moved laterally into internal services and wallet infrastructure to transfer digital assets. The activity was also linked to deployment of **AnyDesk**, keylogging, and **XMRig** cryptominers, and to broader cloud and SaaS tampering that redirected cryptocurrency transactions; public attributions have connected the cluster to major thefts including the **DMM Bitcoin** and **Bybit** heists, underscoring an ongoing campaign against crypto-sector development and production environments.
Aug 15, 2026