North Korean Actors Deploy FLATROOF and ROOFDECK via Compromised Terraform Infrastructure Tool

Zscaler ThreatLabz reported in July 2026 that the suspected TraderTraitor group deployed a trojanized Terraform provider to infect developer environments. This infrastructure-as-code tool executed malicious code immediately upon loading, bypassing standard checks while maintaining normal functionality to avoid detection by users.

In plain English

The attackers disguised their malware inside a legitimate-looking Terraform provider, a software component that allows Terraform to manage cloud resources. When developers installed or updated this provider, the hidden malicious code ran automatically. It downloaded a Bash loader from a domain mimicking HashiCorp, the company behind Terraform.

This loader acted as a universal delivery mechanism. It detected the victim’s operating system and CPU architecture, then selected the appropriate payload. The campaign targeted Windows, Linux, and macOS systems, ensuring that developers using any common platform could be infected by the same initial vector.

The primary payload was FLATROOF, a malware family designed to steal sensitive data from the infected machine. It deployed Python scripts to harvest credentials and other confidential information. After securing this initial access and data theft, the malware dropped ROOFDECK, a backdoor that provided the attackers with full remote control over the compromised system.

The background

TraderTraitor, also known as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces, is an advanced persistent threat actor backed by the North Korean government. The group has historically targeted the cryptocurrency industry for financial gain. This July 2026 campaign overlaps significantly with the previously reported KelpDAO incident, which involved similar malware families.

GBHackers noted that attribution to TraderTraitor remains provisional. Zscaler ThreatLabz found similarities in targeting, tooling, and tactics between this campaign and previous operations by the group. However, the researchers lacked unique code matches, shared infrastructure, or cryptographic evidence to definitively link the attacks.

The malware employs sophisticated techniques to evade detection. It conceals and retrieves its final command-and-control address dynamically. This method helps the attackers avoid static analysis and network monitoring tools that look for known malicious domains or IP addresses.

What changes now

Security operations teams should review their Terraform provider registries and verify the integrity of all installed components. The use of lookalike domains suggests that supply chain attacks on developer tools are becoming more prevalent. Organizations must monitor for unusual outbound connections from development workstations, particularly those originating from infrastructure management tools.

No vendor patch or fix has been confirmed yet for this specific trojanized provider. Teams should assume that any unverified provider could contain malicious code. Monitoring for the presence of FLATROOF and ROOFDECK indicators is critical for early detection of ongoing compromises in developer environments.

Background: Supply chain attacks

Small businesses face supply chain attacks because attackers target weaker vendors to reach you. Protect your network by enforcing least privilege, verifying software signatures, and demanding strict access logs from your IT provider. Isolate critical data and assume third-party tools can be compromised at any time.

Read the full guide: Supply Chain Attack Risks and Protection for Small Business

What to do and how to stay safe: TraderTraitor

• Audit all Terraform providers and infrastructure-as-code dependencies for unauthorized modifications or unexpected hashes.
• Monitor network traffic from development environments for connections to domains resembling vendor names but hosted on different infrastructure.
• Implement strict access controls and integrity checks for software repositories used by engineering teams.
• Watch for anomalous Python script executions or unexpected backdoor processes on developer workstations.

Step-by-step guide: Ransomware Explained: How File Locking Works and What to Do

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What malware families were used in this campaign?

The campaign deployed FLATROOF for credential theft and data exfiltration, followed by ROOFDECK to establish a persistent remote access backdoor.

Is this attack linked to North Korea?

Attribution is provisional. Zscaler links it to TraderTraitor based on tactical similarities, though unique code matches or cryptographic evidence are lacking.

Which operating systems are affected?

The Bash loader selects payloads tailored to the victim's environment, affecting Windows, Linux, and macOS systems based on their OS and CPU architecture.