Threats Tagged 'tradertraitor'

In July 2026, a sophisticated malware campaign attributed to the TraderTraitor group was uncovered, leveraging a trojanized Terraform provider to target cryptocurrency and Web3 developers. The attack uses a malicious Terraform provider that downloads a Bash loader from a HashiCorp-themed lookalike domain, which then deploys platform-specific payloads for macOS, Linux, and Windows. Encrypted executables are hidden in fake font files and decrypted with AES-256-CBC. The campaign delivers FLATROOF, a Rust-based backdoor with multiple command and control (C2) channels, and Python-based information stealers targeting browser credentials and cryptocurrency wallet data. The attack concludes with deployment of the ROOFDECK backdoor, which uses resilient C2 discovery methods including cryptographically signed Pastebin dead drops and Nostr metadata.