TraderTraitor Backdoors Found on an IT Services Provider’s Mac

Sep 18, 2026 · Original article ↗

Summary

SentinelOne found TraderTraitor’s FLATROOF and ROOFDECK backdoors on an Indian IT services provider’s Mac and identified fake job-interview projects using malicious Terraform provider lock files. The infection route for this victim remains unproven.

Key points

The victim was an Indian IT services provider with no cryptocurrency ties; telemetry identified one affected Apple Silicon Mac belonging to a DevOps engineer.
Researchers found weaponized Terraform lock files in fake coding-project repositories used in job-interview lures. Running `terraform init` with a malicious provider could download and execute attacker-controlled code.
SentinelOne could not confirm how the backdoors reached this victim’s Mac; both were present by March 18, 2026, and began running on March 29.
The Rust-based macOS backdoors, FLATROOF and ROOFDECK, can collect system and browser data, command histories, and the login keychain; ROOFDECK also supports remote commands, file transfer, reconnaissance, and persistence.
A later ROOFDECK version beaconed to a new command-and-control server until June 1; the binary was moved to Trash on June 17.
SentinelOne recommends monitoring developer endpoints for unsigned binaries and suspicious IDE child processes, and checking Terraform provider sources before running unfamiliar projects.

Article Details

Attack Vectors: TraderTraitor used fake job interviews to direct developers to coding projects containing weaponized Terraform lock files.
The lock files specified custom providers hosted on attacker-controlled, typosquatted registry domains. Running terraform init downloaded and executed the malicious provider modules.
In the additional victim's case, telemetry established that both backdoors were present by 2026-03-18, but did not establish how they were delivered. Cursor launched them when a development workspace was opened on 2026-03-29.
According to the LayerZero Labs report, the attackers installed the backdoors after an employee installed a weaponized interview project on a company workstation.
Defensive Notes: Prioritize endpoint monitoring for engineers with cloud permissions and source-control access. Investigate unsigned binaries running from home directories, unexpected IDE child processes, and outbound TLS from either.
Follow up on unsolicited coding repositories and interview assignments; consider restricting external job interviews on corporate workstations.
Before running a Terraform project with an included .terraform.lock.hcl file, verify its provider registries and investigate package sources, including packages on the official registry.
Train developers with sensitive access to recognize typosquatted provider domains and the risks of running projects of unknown origin.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`anesthesiaschool[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
DOMAIN	`galaxy-royal[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
DOMAIN	`grenight[.]com`	ROOFDECK command-and-control domain used by the later loginwindow binary.
DOMAIN	`heyhay[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
DOMAIN	`mactroubleshoots[.]pro`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
DOMAIN	`registry[.]hashicorp-aws[.]com`	Attacker-controlled Terraform provider registry specified by weaponized lock files.
DOMAIN	`registry[.]hashicorp-aws[.]io`	Attacker-controlled Terraform provider registry specified by weaponized lock files.
DOMAIN	`registry[.]hashicorp-terraform[.]io`	Attacker-controlled Terraform provider registry specified by weaponized lock files.
DOMAIN	`storage[.]hubpage[.]cloud`	ROOFDECK command-and-control domain.
DOMAIN	`technicais[.]sytes[.]net`	FLATROOF command-and-control domain.
DOMAIN	`tinklify[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
DOMAIN	`vaimage[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`185-66-91-112[.]cprapid[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`213-111-146-132[.]cprapid[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`app[.]heyhay[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`dela[.]servehttp[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`game[.]galaxy-royal[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`mx01[.]galaxy-royal[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`ns4[.]galaxy-royal[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`update[.]heyhay[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`wss[.]sytes[.]net`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`www[.]anesthesiaschool[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`www[.]freehealth[.]lat`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`www[.]heyhay[.]online`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`www[.]mactroubleshoots[.]pro`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
HOSTNAME	`www[.]tinklify[.]com`	Listed among domains associated with the custom certificate's 'ub' user metadata; C2 use was not established.
IPV4	`176[.]97[.]114[.]232`	FLATROOF command-and-control IP associated with technicais.sytes[.]net.
IPV4	`45[.]11[.]59[.]140`	ROOFDECK command-and-control IP associated with storage.hubpage[.]cloud.
IPV4	`85[.]137[.]56[.]10`	Server from which ROOFDECK staged the later loginwindow payload.
IPV4	`85[.]137[.]56[.]245`	ROOFDECK command-and-control IP associated with grenight[.]com.
SHA1	`02df07a173ab03b82a4fb6a08973fff8b1467f28`	FLATROOF backdoor binary identified as SystemUpdate.
SHA1	`4ad92bf92ee614b05c340ce17bef7b6ef5a25e82`	SHA-1 fingerprint of the custom certificate identified for ROOFDECK TLS communication.
SHA1	`5728b11d30586bbfc1d8bd12df1c722a06e767a2`	Stripped ROOFDECK backdoor binary identified as loginwindow.
SHA1	`c491d477dbe0ae04e9aed9dbe237144c03f73ec4`	ROOFDECK backdoor binary identified as iSync.
SHA256	`4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa`	SHA-256 fingerprint of the custom certificate identified for ROOFDECK TLS communication.
URL	`hxxps[:]//github[.]com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/[.]terraform[.]lock[.]hcl`	Specific GitHub file identified as a weaponized Terraform lock file.
URL	`hxxps[:]//github[.]com/exubient0/terraform-candidate-repo/blob/main/[.]terraform[.]lock[.]hcl`	Specific GitHub file identified as a weaponized Terraform lock file.
URL	`hxxps[:]//github[.]com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/[.]terraform[.]lock[.]hcl`	Specific GitHub file identified as a weaponized Terraform lock file.
URL	`hxxps[:]//github[.]com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README[.]md?plain=1#L175`	Specific coding-challenge README reference to a weaponized Terraform provider domain.
URL	`hxxps[:]//github[.]com/Steed-LHV/assessment`	Coding-challenge repository listed as containing README references to a weaponized Terraform provider domain.