TraderTraitor Toolkit Analysis Finds Earlier Malware, but Binance Link Remains Unconfirmed
Summary
ReversingLabs details TraderTraitor-associated developer malware found in telemetry before public disclosure, including earlier ROOFDECK samples. The FBI attributed the Binance theft to TraderTraitor, but no link to the analyzed samples is established.
Key points
- Binance reported a theft of approximately $6.34 billion on October 29, 2026; the FBI attributed it to North Korea’s TraderTraitor operation on October 31.
- Binance’s incident findings describe malicious developer tooling, compromised engineering systems, stolen credentials and deployment access, and unauthorized transactions through wallet-signing infrastructure.
- ReversingLabs first saw a trojanized Terraform AWS provider 77 days before its public documentation; it appeared alongside 16 legitimate provider builds.
- The analyzed chain uses a shell loader and font files containing encrypted payloads to deliver FLATROOF, which can run credential stealers and install the ROOFDECK backdoor.
- ReversingLabs found two likely earlier macOS ROOFDECK builds and a Windows sample first seen in 2025; the article notes the earlier-build assessment is based on similarity and telemetry.
- The article provides YARA, Sigma and hunting guidance for malicious Terraform providers, staged font payloads and related persistence, while noting the ruleset hunt was partial.
- ReversingLabs says the malware samples it analyzed are not established as part of the Binance intrusion; two additional suspected payload files remain unavailable for validation.
Article Details
- Attack Vectors
- Binance reported that an engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool, exposing information about the engineer's role and colleagues.
- A fraudulent recruiter directed an engineer to a coding-assignment repository containing malicious setup code that replaced a legitimate development-tool component.
- A weaponized .terraform.lock.hcl file referenced a lookalike registry and caused terraform init to pull a trojanized Terraform provider that staged a shell loader and encrypted payload.
- According to Binance, attackers used a compromised workstation and an internal AI tool to reach two additional engineering systems and obtain credentials and a container deployment token.
- The reported malware chain used FLATROOF to run Python credential stealers and install ROOFDECK; the stolen credentials and deployment access were used to reach wallet-signing infrastructure.
- Defensive Notes
- Treat infrastructure-as-code initialization as code execution; pin providers to registry.terraform.io, verify signatures, and block access to lookalike registries.
- Do not run interview or take-home repositories on work machines. Use disposable environments without corporate SSO, cloud credentials, or signing-system access.
- Separate engineer endpoints from signing paths; use a hardened device and human approval for signing requests. Monitor EIP-7702 delegations and maintain a tested revocation procedure.
- Hunt for WOFF files containing the @@ENDFONT@@ marker followed by an encoded payload, Terraform provider processes spawning shells or download utilities, safari_updater, and the reported persistence locations.
- Treat the HivePro indicators from 2020–2022 as historical hunting context rather than 2026 blocklist indicators; the article warns that blocking them may produce false positives.
- Do not treat the ReversingLabs samples discussed in the article as confirmed Binance artifacts; the source says their connection to the Binance intrusion has not been established.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | delay[.]servehttp[.]com | ROOFDECK command-and-control domain described as resolved through a Nostr profile and Pastebin. |
| DOMAIN | registry[.]hashicorp-aws[.]com | Lookalike registry identified as part of the 2026 malicious Terraform toolset. |
| DOMAIN | registry[.]hashicorp-terraform[.]io | Lookalike Terraform registry referenced by weaponized lock files to obtain the malicious provider. |
| DOMAIN | supportaru[.]serveftp[.]com | Listed as a FLATROOF payload host; the loader's shown URL uses a doubled scheme and cannot succeed as written. |
| DOMAIN | technicais[.]sytes[.]net | Historical HivePro indicator; ReversingLabs reported one malicious download from this domain. |
| IPV4 | 176[.]97[.]114[.]232 | Historical HivePro indicator; the article identifies it as the only listed IP from which ReversingLabs held a malicious download. |
| MD5 | 116f7189ed7b41f1b339a749d56e63be | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 2621753691be9521288664bb551dfba6 | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 34a52e6a4d803e94fe497bab682abfd3 | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 3826dc7a9ba8bd5b1c143560c1530d89 | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 4b8509cde757b5428e5f99c8dffe73ca | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 58fa0d651898446d5f5d2ed8a27a3330 | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| MD5 | 73adaea97f003735335505858c1c6def | Malicious safari_updater Bash loader. |
| MD5 | 9d78ece09457907b730d139e4e0c64dd | Malicious trojanized Terraform provider identified as MacOS.Trojan.Multiverze. |
| MD5 | ad0b1b6d2c8b9d09d6473a4a299470ab | Zscaler-published MD5 for one of the other FLATROOF font containers absent from the ReversingLabs repository. |
| SHA1 | 4402e44c0bc959ac22340041413de2482e8b5d53 | Malicious FLATROOF font container for macOS ARM64. |
| SHA1 | 8473f85bda00dfa3ecd2385dd38f69600d1d64a6 | Malicious trojanized Terraform provider identified as MacOS.Trojan.Multiverze. |
| SHA1 | d81081691c3631f3adc1a6db0ee22ab19682ef30 | Malicious safari_updater Bash loader. |
| SHA256 | 188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666 | Malicious trojanized terraform-provider-awsbeta_v1.0.0 binary. |
| SHA256 | 451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97 | Malicious safari_updater Bash loader that retrieves and decrypts the staged payload. |
| SHA256 | 62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38 | Malicious FLATROOF font container holding an encrypted payload. |
| URL | hxxps[:]//arusupport-region1-webhook[.]online | Reported FLATROOF command-and-control endpoint and a URL flagged by a third-party source. |
| URL | hxxps[:]//diagnose[.]hashicorp-terraform[.]io/plugins/grpc/v6/schema/metrics/333afe63-c5a2-43f0-b046-7cbaa7797e8a | Specific URL published as the malicious provider's Bash-loader download location. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/ | GitHub mirror URL embedded in the FLATROOF loader for retrieving font-container payloads. |
| URL | hxxps[:]//stage-fashion365[.]vercel[.]app/static/tinymce4.7.5/plugins/fonts/v1104 | Fallback payload URL embedded in the FLATROOF loader. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe font container disguises an encrypted executable behind decoy WOFF data, a marker, and a Base64-encoded AES-256-CBC payload.T1059.004 · Unix ShellThe provider launches safari_updater, a Bash shell script that retrieves and stages the payload.T1102.002 · Bidirectional CommunicationThe article lists Telegram bot and GitHub API services among the FLATROOF command-and-control channels.T1105 · Ingress Tool TransferThe loader downloads a Bash script and font-container payloads from reported network locations and mirrors.T1195.001 · Compromise Software Dependencies and Development ToolsA trojanized Terraform provider was obtained through a weaponized .terraform.lock.hcl reference to a lookalike registry.T1204.002 · Malicious FileThe engineer ran terraform init in the lure project, triggering execution of the malicious provider.T1546.004 · Unix Shell Configuration ModificationThe infection chain describes a macOS ~/.zlogout hook used for persistence.T1547.001 · Registry Run Keys / Startup FolderThe infection chain describes a Windows HKCU Run entry named powershell-config-service.T1553.001 · Gatekeeper BypassOn macOS, the loader removes com.apple.quarantine and ad-hoc signs the payload before launching it.T1555.001 · KeychainThe reported Python stealers collect macOS keychain data.T1555.003 · Credentials from Web BrowsersThe reported Python stealers collect browser cookies and logins from infected systems.T1566.003 · Spearphishing via ServiceA fraudulent recruiter used a job-interview or coding-assignment lure to direct an engineer to a malicious repository.
People
Threat Actors
Jade SleetThe FBI officially attributed the Binance theft to TraderTraitor on October 31, 2026. The article cautions that this attribution does not establish that the specific ReversingLabs malware samples were used in the Binance intrusion.LazarusThe article describes TraderTraitor as a North Korean cluster within the broader Lazarus umbrella; it does not attribute the Binance theft directly to Lazarus.
Malware
FLATROOFWhether the specific Terraform provider, FLATROOF, or ROOFDECK samples analyzed by ReversingLabs were involved in the Binance intrusion.Gaslightalready held it (SHA-256 3c254614de8c1a2f...), classified malicious under the name MacOS.Trojan.Gaslight, flagged by 10 of 24 scanners and first seen at 01:17:59 UTC on July 23, 2026, inside the sameMultiverze01:06 UTC, 77 days before the public write-up. RL classifies it as malicious, threat name MacOS.Trojan.Multiverze. It is a 17.5 MB 64-bit Mach-O built from Go.ROOFDECKWhether the specific Terraform provider, FLATROOF, or ROOFDECK samples analyzed by ReversingLabs were involved in the Binance intrusion.
Vendors
GitHubIt tries three base URLs in order: hxxps://https://supportaru[.]serveftp[.]com/statics/cache/v11, then a GitHub mirror underReversingLabsThat is where ReversingLabs' original research provides additional insight.TelegramMach-O 64-bit arm64 executable written in Rust, with Rust crate paths under /Users/dev/.cargo/, Telegram error strings and a "~/.zlogout created by script" marker, all consistent with Zscaler's description ofVercelthen hxxps://stage-fashion365[.]vercel[.]app/static/tinymce4.7.5/plugins/fonts/v1104. The primary entry carries a doubled scheme,
Products
HomebrewJune 2026 — Initial exposure: A Wallet DevOps engineer downloaded a tampered Homebrew installation while attempting to install an AI coding tool. Binance detected the activity and replaced the affected device, but theSpectra AnalyzeAPI (TCA-0101), cross-checked against the warehouse. The summary tiles in the figures show Spectra Analyze's "community threat detections" count, which runs one or two lower.Spectra Corequeried the RL data warehouse for submission history, scanner coverage and ATT&CK mappings produced by Spectra Core. Classifications, threat names and scanner counts come from the Spectra Intelligence File ReputationSpectra Detectand RHA similarity search, which surfaced the ROOFDECK siblings, can be re-run as new samples appear. Spectra Detect customers can deploy the YARA rule at ingestion to flag font files carrying staged payloads in buildSpectra IntelligenceRL researchers looked up every published file and network indicator in Spectra Intelligence, ran similarity (RHA) pivots on each sample RL holds, and queried the RL data warehouse for submission history, scannerTerraformWhether the specific Terraform provider, FLATROOF, or ROOFDECK samples analyzed by ReversingLabs were involved in the Binance intrusion.
Tools
Joe SandboxUTC, minutes before the first Binance outflow. RL warehouse data shows they were written by three Joe Sandbox URL analyses of the published Zscaler URLs, run on Linux with Firefox 112, each returning "no threatsSigmaSigma: Terraform provider spawning a shell or downloaderYARAThe contents of two previously unpublished WOFF files surfaced by ReversingLabs' YARA hunting, which were unavailable for download and further validation.