Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.

• Binance heist: what we know, and what we see in TraderTraitor's toolkitMalware2026-11-05
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwareMalware2026-10-08
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05