Executive Summary
In July 2026, Zscaler ThreatLabz identified a campaign suspected to be orchestrated by TraderTraitor (Jade Sleet, UNC4899), a North Korean-backed threat actor. The campaign targets cryptocurrency and Web3 developers by distributing a malicious Go-based Terraform provider, `terraform-provider-awsbeta_v1.0.0`. This trojanized provider executes a multi-stage infection chain that begins with a Bash loader and culminates in the deployment of FLATROOF and ROOFDECK malware families across Windows, macOS, and Linux platforms.
The attack is notable for its sophisticated delivery and resilience mechanisms. Payloads are masqueraded as web font files (.woff) and hosted on legitimate platforms like GitHub and Vercel. The FLATROOF malware utilizes Python-based stealers to harvest browser credentials and cryptocurrency wallet data, while the ROOFDECK backdoor employs a tiered command-and-control (C2) discovery process involving signed Pastebin files and Nostr profile metadata. This highlights a strategic focus on compromising developer environments to gain access to high-value cryptocurrency assets.
This campaign represents a significant risk to organizations utilizing Infrastructure-as-Code (IaC) workflows. By compromising the tools developers trust, the actors can bypass traditional perimeter defenses and establish persistent access within CI/CD pipelines and engineering workstations. The cross-platform nature of the malware ensures that regardless of the developer's operating system, the threat actor can exfiltrate sensitive credentials and maintain remote control.