A Fake Terraform File Rooted an IT Services Firm

SentinelOne researchers disclosed that Jade Sleet, the North Korean threat cluster also known as TraderTraitor, compromised an India-based IT services company by planting a weaponized Terraform provider file on a DevOps engineer’s Apple Silicon Mac. The engineer, who held cloud credentials and source control access spanning AWS, OVH and OpenStack, ran a project containing a malicious .terraform.lock.hcl file pointing to typosquatted provider domains built to look like HashiCorp’s own registry. The intrusion, live as early as March 18, 2026, deployed two ARM64 backdoors: FLATROOF, tracked elsewhere as macOS.Gaslight, which uses Telegram for command and control and harvests browser data and keychain contents, and ROOFDECK, a more capable reconnaissance and lateral-movement tool that discovers its command infrastructure over the Nostr protocol and cryptographically signs its own commands.

Why it matters: the victim here had no cryptocurrency exposure, the trait that has defined nearly every prior TraderTraitor target since the group’s name became synonymous with crypto-exchange theft. SentinelOne’s own framing is direct: “endpoints used for development carry access to cloud, pipelines and source code, which makes monitoring and protection a high priority.” A developer laptop with Terraform state and cloud credentials is now a target in its own right, independent of what the company that laptop belongs to actually does.

The original insight here is in the delivery mechanism, not the payload. Terraform provider files are infrastructure-as-code plumbing that most security tooling never inspects the way it inspects a downloaded binary or a suspicious email attachment. A typosquatted provider domain sitting in a lockfile is the kind of artifact a DevOps engineer would routinely approve without a second look, which is exactly why Jade Sleet chose it. CyberTech has previously covered a related DPRK-linked macOS.Gaslight backdoor built to evade AI-assisted malware analysis, and the group’s fake-job social engineering echoes the WaterPlum recruiter-lure campaign detailed in a joint government advisory this month.

Source: SentinelOne