Researchers at Zscaler ThreatLabz and SentinelLabs have detailed a supply-chain campaign in which a trojanized Terraform provider binary installs two backdoors, FLATROOF and ROOFDECK, on developer machines. The researchers attribute the activity to the TraderTraitor cluster, but only with low confidence, and the number of victims has not been disclosed.
Fake AWS Terraform Provider Targets Cloud and Web3 Engineers
The malicious file is a Terraform provider binary named terraform-provider-awsbeta, which impersonates a legitimate AWS plugin. Terraform is infrastructure-as-code tooling used by cloud engineers, and the campaign is aimed at those engineers and at crypto and Web3 developers who use it. Activity was first discovered in July, and the Zscaler and SentinelLabs findings were published on October 12.
Because the lure is a provider that engineers would install and run as part of normal infrastructure work, the compromise lands on workstations that hold cloud credentials and cryptocurrency wallet data. According to the research, that combination makes the campaign a credential and crypto theft operation as much as an espionage tool.
How the awsbeta Binary Pulls a Bash Loader From a Lookalike Domain
When the trojanized binary runs, it contacts the lookalike domain hashicorp-terraform[.]io and retrieves a Bash loader. The domain imitates the name of the vendor behind Terraform, which gives the traffic a familiar appearance in logs and network monitoring.
The loader then fetches encrypted payloads that are disguised as web fonts. Those files are hosted on dynamic DNS services, GitHub or Vercel, according to the researchers, so the delivery infrastructure mixes throwaway hostnames with widely used developer platforms.
FLATROOF and ROOFDECK Give the Operators Persistent Access
The two backdoors serve different roles on the infected machine. Together they cover command execution, file handling, credential theft and wallet theft across all three major desktop operating systems.
FLATROOF: A Rust Backdoor for macOS, Linux and Windows
FLATROOF is written in Rust and runs on macOS, Linux and Windows. It establishes persistence on the host and communicates with its operators over Telegram, GitHub or webhook command-and-control channels. The researchers also describe Python scripts that accompany it and steal browser credentials and crypto-wallet data.
The use of Telegram and GitHub as command channels means the backdoor’s outbound traffic goes to services that many organizations allow by default.
ROOFDECK: A Secondary Windows and macOS Implant
ROOFDECK is a secondary backdoor for Windows and macOS. Its listed capabilities are command execution, reverse shells, file operations and clipboard manipulation. Clipboard manipulation is relevant to cryptocurrency theft because wallet addresses are routinely copied and pasted during transfers.
Why Attribution to TraderTraitor Remains Low Confidence
The researchers attribute the campaign to TraderTraitor, a cluster that is also tracked as Jade Sleet, UNC4899, Pressure Chollima and Slow Pisces. They rate that assessment as low confidence. According to the research, no unique code, infrastructure or cryptographic links to the group were found.
That gap matters for how the findings should be read. The researchers did not point to technical overlaps, so the name TraderTraitor reflects their best assessment, not a confirmed link.
Indicators Published, No Patch Applies
Because the attack relies on a counterfeit binary rather than a flaw in Terraform or AWS software, no vendor patch applies. Zscaler and SentinelLabs published indicators of compromise instead, including the lookalike domain, the binary name and the delivery infrastructure on dynamic DNS, GitHub and Vercel.
The timing of the disclosure is a point of note: the activity was discovered in July, and the public report followed on October 12. The researchers did not disclose how many developers installed the malicious provider or whether any cloud accounts or wallets were drained.
For defenders, the published indicators give a concrete list to search for in endpoint and DNS records: the terraform-provider-awsbeta file name, connections to hashicorp-terraform[.]io, and fetches of font-named files from the hosting services listed above. Any machine where the binary executed would have exposed whatever browser credentials, cloud credentials and wallet data it held, given FLATROOF’s stated theft capabilities.
