A North Korean hacking group known as TraderTraitor (also tracked as UNC4899, PUKCHONG, and Jade Sleet) has launched a deceptive campaign targeting macOS developers through fake Terraform interview assignments. By hijacking the trust in recruitment processes, the group gains access to cloud infrastructure and installs sophisticated backdoors on compromised systems.
How the Attack Works
TraderTraitor reaches out to professionals with DevOps, cryptocurrency, or financial-technology backgrounds and provides infrastructure-themed coding assignments hosted in GitHub. These tasks look legitimate, with names like Northwind-IAC, novacart-interview, and terraform-candidate-repo. One file—the .terraform.lock.hcl lock file—is engineered to redirect Terraform operations to attacker-controlled provider registries rather than legitimate sources. Running terraform init then causes malicious provider modules to execute.
macOS Backdoors & Deep Cloud Access
In one documented incident, an Apple Silicon MacBook used by a DevOps engineer at an Indian IT services company was compromised. The machine held credentials for AWS, OVH, and OpenStack, plus source-control access. The attack dropped two implants: FLATROOF and ROOFDECK, both masquerading as benign system tools.
FLATROOF pretended to be “SystemUpdate” and focused on reconnaissance—collecting browser and terminal histories, gathering application lists, running shell commands, uploading files via Telegram, and stealing login keychain data. ROOFDECK, disguised as “iSync,” offered broader control: searching files, executing arbitrary commands, creating encrypted archives, exfiltrating data, reading the clipboard, and maintaining persistence through a LaunchAgent. Its communications are routed via the decentralized Nostr network.
After several weeks of operation, the attackers withdrew the original implants and deployed a stripped-down version of ROOFDECK, called loginwindow, continuing communication through June 1. This shift demonstrates their ability to refresh tools mid-intrusion and limit visibility on the compromised device.
What Organizations Can Do
This operation underscores that even casual or external-facing tasks—like interview assignments—can serve as attack vectors. The risk is especially high for anyone with cloud or source-control privileges. Security teams should monitor for signs such as unsigned binaries running from home directories, unexpected child processes spawned from development tools, and unusual encrypted outbound traffic.
Developers should avoid running external assessments on work devices, and always inspect .terraform.lock.hcl files before doing so. Any provider not from the official registry.terraform.io namespace should be treated with suspicion, and even packages from known registries should be traced back to their creators.
Indicators of Compromise
The report includes SHA-1 hashes for FLATROOF (masquerading as SystemUpdate), ROOFDECK (as iSync), and its stripped version loginwindow. Several domains used for command-and-control (C2) have been identified, as well as fake provider domains like registry.hashicorp-aws[.]com and registry.hashicorp-terraform[.]io. File paths for binaries lie in users’ Library folders under names like SystemUpdate and iSync, and persistence is achieved via LaunchAgents and configuration files in hidden home directories.
Having outlined what’s happening, it’s clear this campaign isn’t about isolated threats—it’s part of a sophisticated supply chain gambit.
Why it Matters: TraderTraitor’s approach blends recruitment tactics with advanced malware to leap from interview tasks into controlling cloud environments. For roles with elevated privileges, the risk isn’t just losing access—it’s potential full domain compromise.
