TraderTraitor This time isn’t targeting contracts—it’s targeting developers’ workflows.
According to disclosures by SlowMist, the North Korea–linked threat group TraderTraitor (also known as UNC4899 and Jade Sleet) has launched another campaign. Recently, it compromised an IT services company located in India that is unrelated to the cryptocurrency industry. The attackers first posted a fake job listing on GitHub, using “technical interview assignments” as bait to go after DevOps and crypto engineers.
After victims downloaded the project, the malicious .terraform.lock.hcl would point to a Terraform Provider domain controlled by the attackers. Running terraform init is enough to trigger the download and execution of a malicious module. Ultimately, on macOS devices, the attackers deployed a Rust/ARM64 backdoor called FLATROOF and ROOFDECK. Its capabilities include stealing credentials and sensitive data, executing shell commands, collecting and exfiltrating files, and obtaining access to cloud services and code repositories.
More concerning is that this time the targets aren’t limited to the crypto industry. The attackers may be paying more attention to cloud and API access permissions such as AWS, GCP, OVH, and OpenStack. One scenario is that developers simply pull an unknown interview repository directly onto their work machines; another is that an enterprise overlooks the Provider origin and anomalous IDE subprocesses. Which would you check first: the .terraform.lock.hcl, or isolating the unfamiliar project first?
Source: BlockBeats
Figure 1: TraderTraitor attacks developers by abusing a malicious Terraform project · partial screenshot from the source page
Image source: https://www.theblockbeats.info/flash/368366
According to disclosures by SlowMist, the North Korea–linked threat group TraderTraitor (also known as UNC4899 and Jade Sleet) has launched another campaign. Recently, it compromised an IT services company located in India that is unrelated to the cryptocurrency industry. The attackers first posted a fake job listing on GitHub, using “technical interview assignments” as bait to go after DevOps and crypto engineers.
After victims downloaded the project, the malicious .terraform.lock.hcl would point to a Terraform Provider domain controlled by the attackers. Running terraform init is enough to trigger the download and execution of a malicious module. Ultimately, on macOS devices, the attackers deployed a Rust/ARM64 backdoor called FLATROOF and ROOFDECK. Its capabilities include stealing credentials and sensitive data, executing shell commands, collecting and exfiltrating files, and obtaining access to cloud services and code repositories.
More concerning is that this time the targets aren’t limited to the crypto industry. The attackers may be paying more attention to cloud and API access permissions such as AWS, GCP, OVH, and OpenStack. One scenario is that developers simply pull an unknown interview repository directly onto their work machines; another is that an enterprise overlooks the Provider origin and anomalous IDE subprocesses. Which would you check first: the .terraform.lock.hcl, or isolating the unfamiliar project first?
Source: BlockBeats
Figure 1: TraderTraitor attacks developers by abusing a malicious Terraform project · partial screenshot from the source page
Image source: https://www.theblockbeats.info/flash/368366
