Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

This threat involves a multi-stage malware campaign by the TraderTraitor group using a trojanized Terraform provider as the initial infection vector. The malicious provider downloads a Bash loader from a domain mimicking HashiCorp's infrastructure, which selects and deploys payloads tailored to the victim's OS (macOS, Linux, Windows). Encrypted payloads are concealed within fake font files and decrypted using AES-256-CBC. The campaign installs FLATROOF, a Rust-based backdoor with platform-specific persistence and multiple C2 channels such as Telegram Bot API and GitHub. Additionally, Python-based stealers exfiltrate browser credentials, cookies, cryptocurrency wallet extensions, and system information. The final stage deploys the ROOFDECK backdoor, which uses cryptographically signed Pastebin dead drops and Nostr profile metadata for resilient C2 communication. Indicators include multiple malicious domains and file hashes. No CVE or patch information is available.

The campaign targets cryptocurrency and Web3 developers, potentially compromising sensitive credentials, cookies, wallet extensions, and system information across multiple operating systems. The malware provides persistent backdoors with multiple C2 channels, enabling ongoing unauthorized access and data exfiltration. The use of trojanized infrastructure-as-code providers increases the risk of supply chain compromise in development environments.

No official patch or remediation is indicated. Defenders should avoid using untrusted or unofficial Terraform providers and verify the authenticity of providers and domains before use. Monitoring for indicators of compromise such as the listed malicious domains and hashes is recommended. Since this is a malware campaign rather than a software vulnerability, remediation involves detection and removal of the malware and securing development environments against supply chain attacks.