--- title: Don’t Call Us, We’ll Call Your APIs | TraderTraitor... description: SentinelOne identified a second victim infected with the FLATROOF and ROOFDECK macOS backdoors previously seen in the TraderTraitor (DPRK-linked Lazarus... canonical: https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | daily.dev og:description: SentinelOne identified a second victim infected with the FLATROOF and ROOFDECK macOS backdoors previously seen in the TraderTraitor (DPRK-linked Lazarus... og:url: https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat og:image: https://api.daily.dev/og/posts/r3BVlUDaT.png og:image:alt: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties **[SentinelLABS](https://daily.dev/sources/sentinelone-labs)** · 16 min read · 0 upvotes · 0 comments ## Summary SentinelOne identified a second victim infected with the FLATROOF and ROOFDECK macOS backdoors previously seen in the TraderTraitor (DPRK-linked Lazarus subgroup) attack on LayerZero/KelpDAO, which had resulted in a $292 million cryptocurrency theft. This new victim was a small IT services company in India with no cryptocurrency ties, showing the attackers' campaigns extend beyond crypto-specific targets. The intrusion began through a fake job interview lure containing a weaponized Terraform coding project: a malicious .terraform.lock.hcl file pointed to attacker-controlled provider registries (typosquatting HashiCorp domains), causing terraform init to download and execute malicious provider code. Once on the DevOps engineer's MacBook, FLATROOF and ROOFDECK (both Rust-based ARM64 backdoors) bypassed Gatekeeper, established persistence via LaunchAgents, and exfiltrated browser data, keychains, and command histories over Telegram and custom C2 servers, including Nostr-based dead-drop resolution. A day after LayerZero's public disclosure, attackers deployed a stripped, harder-to-detect version of ROOFDECK and deleted the original implants, before eventually abandoning the host by June. The report includes detailed C2 command tables, IOCs, and recommendations for organizations and developers to detect and prevent similar Terraform lockfile and interview-lure attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the weaponized Terraform lock file attack used by TraderTraitor actually work? A malicious .terraform.lock.hcl file in a fake job-interview coding repository points to a typosquatted custom provider registry domain such as registry.hashicorp-aws.com instead of the real registry.terraform.io. When the victim runs terraform init, Terraform trusts the lockfile as the source of truth and downloads and executes the attacker's malicious provider modules, deploying macOS backdoors. _Developers vetting unfamiliar Terraform repos before running init can track emerging supply-chain threats on daily.dev._ ### What are the FLATROOF and ROOFDECK macOS backdoors and what can they do? FLATROOF and ROOFDECK are ARM64 Rust-based macOS backdoors used by the DPRK-linked TraderTraitor group. FLATROOF (deployed as SystemUpdate) disables Gatekeeper, harvests browser data, keychain files, and command histories, and exfiltrates via Telegram. ROOFDECK (deployed as iSync) is more advanced, supporting shell access, reverse shells, file operations, clipboard hijacking, and Nostr-based command-and-control resolution with RSA-signed commands. _Security teams monitoring endpoint threats can follow detailed backdoor breakdowns like this on daily.dev._ ### How can developers protect themselves from malicious Terraform provider lockfiles in interview coding tests? Before running any project containing a .terraform.lock.hcl file, verify the provider registry domain matches a known-good namespace under registry.terraform.io or the official provider domain; anything else should be treated as suspect. Even legitimate-looking registries can host malicious packages, so investigating the actual source behind any included lockfile is essential, especially for unsolicited take-home coding assignments from recruiters. _Developers handling take-home coding tests can stay ahead of lockfile-based supply-chain tricks via daily.dev._ ## Similar posts on daily.dev - [TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages...](https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a) · Socket · 0 upvotes · 0 comments - [TrapDoor malware campaign puts developer workstations in CISO spotlight](https://daily.dev/posts/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight-i8q0wnnkh) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#terraform](https://daily.dev/tags/terraform) [View this post on daily.dev](https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties","url":"https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat"},"datePublished":"2026-09-18T17:02:36.768Z","dateModified":"2026-09-18T17:03:07.413Z","description":"SentinelOne identified a second victim infected with the FLATROOF and ROOFDECK macOS backdoors previously seen in the TraderTraitor (DPRK-linked Lazarus...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cb872685df72931ae852abef6a1ef051?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cb872685df72931ae852abef6a1ef051?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SentinelLABS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SentinelLABS","logo":"https://media.daily.dev/image/upload/s--BzJ1lEiU--/f_auto,q_auto/v1780213258/logos/sentinelone-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sentinelone-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,terraform","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SentinelLABS","item":"https://daily.dev/sources/sentinelone-labs"},{"@type":"ListItem","position":3,"name":"Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-tie-r3bvludat#faq","mainEntity":[{"@type":"Question","name":"How does the weaponized Terraform lock file attack used by TraderTraitor actually work?","acceptedAnswer":{"@type":"Answer","text":"A malicious .terraform.lock.hcl file in a fake job-interview coding repository points to a typosquatted custom provider registry domain such as registry.hashicorp-aws.com instead of the real registry.terraform.io. When the victim runs terraform init, Terraform trusts the lockfile as the source of truth and downloads and executes the attacker's malicious provider modules, deploying macOS backdoors. Developers vetting unfamiliar Terraform repos before running init can track emerging supply-chain threats on daily.dev."}},{"@type":"Question","name":"What are the FLATROOF and ROOFDECK macOS backdoors and what can they do?","acceptedAnswer":{"@type":"Answer","text":"FLATROOF and ROOFDECK are ARM64 Rust-based macOS backdoors used by the DPRK-linked TraderTraitor group. FLATROOF (deployed as SystemUpdate) disables Gatekeeper, harvests browser data, keychain files, and command histories, and exfiltrates via Telegram. ROOFDECK (deployed as iSync) is more advanced, supporting shell access, reverse shells, file operations, clipboard hijacking, and Nostr-based command-and-control resolution with RSA-signed commands. Security teams monitoring endpoint threats can follow detailed backdoor breakdowns like this on daily.dev."}},{"@type":"Question","name":"How can developers protect themselves from malicious Terraform provider lockfiles in interview coding tests?","acceptedAnswer":{"@type":"Answer","text":"Before running any project containing a .terraform.lock.hcl file, verify the provider registry domain matches a known-good namespace under registry.terraform.io or the official provider domain; anything else should be treated as suspect. Even legitimate-looking registries can host malicious packages, so investigating the actual source behind any included lockfile is essential, especially for unsolicited take-home coding assignments from recruiters. Developers handling take-home coding tests can stay ahead of lockfile-based supply-chain tricks via daily.dev."}}]} ```