A North Korean crew best known for stealing hundreds of millions of dollars in cryptocurrency spent more than two months inside a MacBook belonging to a DevOps engineer at an Indian IT services company that has nothing to do with crypto. SentinelOne researchers Albert Priego, Alex Delamotte and Matej Havranek found the same two macOS backdoors used in April's attack on LayerZero Labs, the breach behind the theft of USD 292 million from KelpDAO.
The target tells the story. The engineer ran Terraform and Ansible against AWS, OVH and OpenStack on most working days, and the laptop held cloud credentials and source control access. As SentinelOne puts it, "the value of the target is whatever their laptop can reach."
Job interview lures built around Terraform
The group, tracked as TraderTraitor (also known as UNC4899, PUKCHONG and Jade Sleet), is described by SentinelOne as a financially motivated, DPRK state-sponsored Lazarus subgroup. Its campaigns use fake job interviews in the style of the long-running Contagious Interview scheme. Targets are job seekers whose GitHub profiles point to DevOps or crypto and FinTech engineering, and the take-home coding project is an infrastructure repository themed around the company the attackers pretend to be hiring for.
The trap is a weaponized .terraform.lock.hcl file. It names a custom provider on an attacker-controlled domain, so when the candidate runs terraform init, Terraform downloads and executes the malicious provider. Pivoting from the repository LayerZero Labs shared in its incident report, SentinelOne found more lures referencing companies called Northwind and Novacart, with repository names including Northwind-IAC, novacart-interview and terraform-candidate-repo. It is unclear whether those companies are invented or impersonated. In one repository, a candidate apparently spotted the trick and left a note saying they had removed a typosquatted provider from the lock file.
Backdoors that woke up with the code editor
On the Indian victim's machine, both backdoors, FLATROOF (also called macOS.Gaslight) and ROOFDECK, were on disk by 18 March 2026, so SentinelOne cannot prove how they were delivered. They came alive on 29 March, launched by the Cursor code editor seconds after the engineer opened a workspace, and beaconed only while Cursor was running. The engineer also cloned terraform-candidate-repo on 13 April.
FLATROOF, which SentinelLABS first analysed in June, strips the macOS quarantine flag from its partner so Gatekeeper never checks it, and harvests browser data, terminal histories and a raw copy of the login keychain for exfiltration over Telegram. ROOFDECK, also written in Rust, is the heavier tool. It finds its command server by looking up an operator profile on the Nostr network, only runs commands signed with the operator's private key, and supports file theft, reverse shells, process listing and clipboard access, which can capture copied secrets or swap a copied crypto address.
On 20 April, one day after LayerZero Labs went public, the attackers pushed a stripped version of ROOFDECK disguised as loginwindow and used it to delete the original implants. It kept beaconing intermittently to a new server until 1 June. SentinelOne says it can only speculate whether the swap was a reaction to the disclosure, and believes the smaller victim ultimately yielded too little value to sustain the intrusion.
Treat engineers with cloud keys as high-risk endpoints
SentinelOne recommends flagging engineers with cloud engineering permissions and source control access as a sensitive group for endpoint monitoring, and hunting for unsigned binaries executing from home directories and IDE child processes that are not signed IDE components. Developers handed an interview repository should read its .terraform.lock.hcl before running terraform init and check that every provider points to a registry they recognise.
Indicators (defanged): malicious provider domains registry[.]hashicorp-aws[.]com, registry[.]hashicorp-aws[.]io and registry[.]hashicorp-terraform[.]io; C2 grenight[.]com (85[.]137[.]56[.]245); staging server 85[.]137[.]56[.]10; earlier C2 addresses 176[.]97[.]114[.]232 and 45[.]11[.]59[.]140; second ROOFDECK build SHA-1 5728b11d30586bbfc1d8bd12df1c722a06e767a2.
The case is a reminder that these interview lures are not aimed at crypto firms alone. Anyone whose profile advertises infrastructure work is a route into whatever that person can reach, and a small company is simply a smaller prize, not a safer one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.