TraderTraitor-Linked Campaign Uses Trojanized Terraform Provider to Deploy Cross-Platform Malware
Summary
Zscaler details a suspected TraderTraitor campaign that uses a trojanized Terraform provider to deploy FLATROOF and ROOFDECK across Windows, macOS, and Linux, stealing sensitive data and enabling persistent remote access.
Key points
- A malicious Terraform provider runs code when Terraform loads it, downloads a Bash loader, and preserves normal provider behavior.
- The loader selects operating-system- and architecture-specific payloads for Windows, macOS, and Linux, disguising encrypted executables as .woff font files.
- FLATROOF supports platform-specific persistence and multiple C2 channels, including Telegram, GitHub, and HTTP webhooks.
- Python stealers collect browser credentials, cookies, history, system data, terminal history, and cryptocurrency wallet extension data.
- ROOFDECK supports remote command execution, file operations, reverse-shell access, and persistence; it discovers C2 through local configuration, signed Pastebin data, or Nostr metadata.
- Zscaler recommends restricting untrusted Terraform providers, verifying provider checksums, and monitoring unexpected process activity.
Article Details
- Attack Vectors
- A trojanized Terraform provider executes malicious code when Terraform starts the provider, then downloads and launches a Bash loader.
- The loader selects encrypted payloads for macOS, Linux, or Windows and downloads them from a dynamic DNS host, a GitHub repository, or a Vercel-hosted site.
- FLATROOF collects browser artifacts, credentials, cookies, system data, and cryptocurrency wallet extension data for exfiltration.
- ROOFDECK discovers its C2 address from a local configuration file, a signed Pastebin file, or Nostr profile metadata.
- Defensive Notes
- Restrict the use of untrusted Terraform providers and verify provider checksums.
- Monitor for unexpected process activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | delay[.]servehttp[.]com | ROOFDECK C2 server. |
| MD5 | 116f7189ed7b41f1b339a749d56e63be | Hash of an encrypted FLATROOF Mach-O payload. |
| MD5 | 2621753691be9521288664bb551dfba6 | Hash of an encrypted FLATROOF Windows payload. |
| MD5 | 2b81aceab0142472d94eb42e500b27b1 | Hash of the macOS ROOFDECK variant. |
| MD5 | 34a52e6a4d803e94fe497bab682abfd3 | Hash of an encrypted FLATROOF ELF payload. |
| MD5 | 3826dc7a9ba8bd5b1c143560c1530d89 | Hash of an encrypted FLATROOF ELF payload. |
| MD5 | 4b8509cde757b5428e5f99c8dffe73ca | Hash of an encrypted FLATROOF ELF payload. |
| MD5 | 58fa0d651898446d5f5d2ed8a27a3330 | Hash of an encrypted FLATROOF Windows payload. |
| MD5 | 73adaea97f003735335505858c1c6def | Hash of the malicious Bash loader. |
| MD5 | 9d78ece09457907b730d139e4e0c64dd | Hash of the trojanized Terraform provider. |
| MD5 | 9d88b4494c7bc27b10358b68a899ad54 | Hash of the Windows ROOFDECK variant. |
| MD5 | ad0b1b6d2c8b9d09d6473a4a299470ab | Hash of an encrypted FLATROOF ELF payload. |
| MD5 | be60c52ca8a01fef7dc15c2f0ebb77d8 | Hash of an encrypted FLATROOF Mach-O payload. |
| URL | hxxps[:]//arusupport-region1-webhook[.]online/statics/cache/v11/abicfjej | Attacker-controlled FLATROOF C2 server. |
| URL | hxxps[:]//diagnose[.]hashicorp-terraform[.]io/plugins/grpc/v6/schema/metrics/333afe63-c5a2-43f0-b046-7cbaa7797e8a | Malicious URL used to download the Bash loader. |
| URL | hxxps[:]//pastebin[.]com/raw/3yptBDhL | ROOFDECK Pastebin dead-drop URL used to retrieve an encrypted C2 address. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/ | Specific GitHub-hosted URL used to download FLATROOF payloads. |
| URL | hxxps[:]//stage-fashion365[.]vercel[.]app/static/tinymce4.7.5/plugins/fonts/v1104/ | FLATROOF payload download URL. |
| URL | hxxps[:]//supportaru[.]serveftp[.]com/statics/cache/v11/ | FLATROOF payload download URL. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collected local browser, history, system, and other host files for staging.T1041 · Exfiltration Over C2 ChannelFLATROOF supports exfiltration of collected files and command results over its C2 channels.T1055 · Process InjectionA Windows Python component injected a decoded executable into a suspended Chromium process.T1059.004 · Unix ShellThe cross-platform loader is a Bash script launched through a shell.T1071.001 · Web ProtocolsThe malware communicates with C2 over HTTP and WebSocket endpoints.T1105 · Ingress Tool TransferThe provider and Bash loader downloaded subsequent payloads from remote hosts.T1195.002 · Compromise Software Supply ChainThe campaign used a trojanized Terraform provider to execute malicious code when Terraform loaded it.T1539 · Steal Web Session CookieThe scripts collected browser cookies from targeted profiles.T1555.003 · Credentials from Web BrowsersThe Python stealers collected browser credential databases and related browser profile artifacts.
Threat Actors
Malware
FLATROOFoverlaps with the previously reported KelpDAO incident, the analysis of which discussed both FLATROOF and ROOFDECK, two malware families also observed in this campaign. The attackers utilized a trojanizedROOFDECKwith the previously reported KelpDAO incident, the analysis of which discussed both FLATROOF and ROOFDECK, two malware families also observed in this campaign. The attackers utilized a trojanized Terraform