The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.
