TraderTraitor Uses Trojanized Terraform Provider to Deploy Cross-Platform Malware

Zscaler ThreatLabz identified a July 2026 campaign where the North Korean-linked group used a compromised infrastructure tool to deliver OS-specific malware.

Threat Times Intrusion DeskOctober 11, 20262 min read

Share LinkedIn Reddit

Illustration: A generic desktop computer sits on a cluttered desk beside a tangled web of tangled ethernet cables and loose screws. — AI-generated illustration: Threat Times

Key points

Zscaler ThreatLabz discovered a trojanized Terraform provider delivering malware in July 2026.
The campaign targets developer environments with FLATROOF and ROOFDECK malware families.
Attackers use a Bash loader to select payloads based on the victim's operating system.

Zscaler ThreatLabz identified a sophisticated cyberespionage campaign in July 2026 linked to the TraderTraitor group. This North Korean-backed advanced persistent threat actor utilized a trojanized Terraform provider to deliver cross-platform malware to targeted developer environments.

The attackers embedded malicious code within the Terraform provider that executes immediately when the infrastructure tool loads. This technique allows the malware to operate while preserving normal Terraform behavior, making detection difficult for users who trust the legitimate software utility.

Infection Chain and Malware Analysis

The trojanized provider downloads a cross-platform Bash loader from a domain designed to look like a HashiCorp website. This loader assesses the victim's system and selects specific payloads for macOS, Linux, or Windows based on the operating system and CPU architecture.

Once the loader executes, it deploys the FLATROOF malware family. This component uses Python scripts to steal sensitive data and credentials from the victim's environment. After initial access and data theft, the attackers drop the ROOFDECK backdoor to establish full remote control over the compromised system.

Attribution and Context

ThreatLabz attributes this activity to TraderTraitor, also known as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces. The group has a long history of targeting the cryptocurrency industry for financial gain and espionage purposes.

The campaign significantly overlaps with the previously reported KelpDAO incident. Analysts observed both FLATROOF and ROOFDECK malware families in this new campaign, linking the tactics and tooling to previous operations conducted by the same threat actor.

Attribution Challenges and Evidence

GBHackers reported that attribution to TraderTraitor remains provisional despite the strong tactical similarities. ThreatLabz found overlaps in targeting, tooling, and tactics but noted a lack of unique code matches, shared infrastructure, or cryptographic evidence that would definitively prove the connection.

The report highlights that while the behavior aligns with TraderTraitor's known methods, the absence of direct technical links means the attribution is based on circumstantial evidence rather than conclusive proof of shared assets.

What should you do?

Organizations should monitor for unusual network traffic originating from infrastructure automation tools like Terraform. Security teams should verify the integrity of downloaded providers and check for connections to lookalike domains mimicking legitimate vendor sites.

What to do and how to stay safe: TraderTraitor

Monitor network logs for outbound connections from build servers or developer workstations to unknown or suspicious domains, especially those resembling vendor sites.
Verify the cryptographic signatures and checksums of all Terraform providers and other infrastructure-as-code tools before installation or execution.
Implement strict egress filtering to block connections to known malicious infrastructure and limit the ability of compromised hosts to download additional payloads.
Isolate and investigate any systems where Terraform or similar tools exhibit unexpected behavior, such as executing scripts outside of standard workflow processes.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What malware families were used in this campaign?

The campaign utilized FLATROOF for credential theft and data exfiltration, followed by the ROOFDECK backdoor for remote control.

How does the Trojanized Terraform provider work?

It executes malicious code as soon as Terraform loads the provider, downloading a Bash loader from a lookalike domain while maintaining normal software behavior.