TraderTraitor Moves Beyond Crypto: macOS Backdoors Found at Indian IT Firm

SentinelOne has identified a new victim of the TraderTraitor APT, attributed to North Korea: an India-based IT services firm with no connection to cryptocurrency trading. The compromise, documented on March 18, 2026, brings back the same macOS backdoors — FLATROOF and ROOFDECK — previously observed in the LayerZero attack. The finding signals that North Korean APT targeting is expanding beyond the financial sector, with the developer's laptop becoming the new privileged entry point.

The Victim: IT Services, Zero Crypto

Unlike the LayerZero case, the new victim identified by SentinelOne belongs to an entirely different sector. "Unlike the previous high-profile victim, this target was a much smaller organization in the IT services industry," the analysts note. The absence of cryptocurrency links dismantles the hypothesis that TraderTraitor operates exclusively against high-return financial targets. The group appears to be testing a broader targeting model where value lies not in the company itself but in what its devices can reach. As SentinelOne summarizes: "the value of the target is whatever their laptop can reach."

The victim used an Apple Silicon MacBook, typical of DevOps environments. SentinelOne telemetry detected both backdoors in hidden directories under ~/Library/com.apple.iTunesCloud/ and ~/com.apple.internal.ck/ — paths identical to those observed in the LayerZero compromise.

The Delivery Mechanism: Terraform as a Supply-Chain Vector

The infection followed a pattern attributable to the "Contagious Interview" campaign previously documented by SentinelOne, with a significant technical addition. The targeted candidates' GitHub profiles were oriented toward DevOps or crypto/FinTech engineering projects. The repositories contained manipulated .terraform.lock.hcl files: these files, normally used to guarantee Terraform provider integrity, were weaponized to point to custom registry domains controlled by the attacker.

Three malicious provider domains were identified across multiple repositories. Running terraform init downloaded and executed the malicious module, installing the backdoors on the victim's system. The mechanism exploits the implicit trust developers place in lock files — a pattern that turns an infrastructure auditing tool into a compromise vector.

A detail collected by SentinelOne illustrates the tension between awareness and deception: in one case, the interviewed candidate had added a note indicating they had removed a typosquatted provider from the original lock file, "which may suggest they thought the interviewer was testing for their security awareness." The apparently prudent maneuver did not neutralize the threat.

Cursor Gating: Beaconing Conditioned on User Activity

The backdoors were present on disk as early as March 18, 2026. Execution, however, began only 11 days later, at 05:00:53 UTC on March 29, 2026, with an unusual detail: both implants were launched by the Cursor IDE. From March 30 to April 19, 2026, FLATROOF and ROOFDECK beaconed exclusively during Cursor sessions, remaining inactive when the IDE was closed.

This behavioral gating represents an evolution in evasion. The backdoor blends into normal development traffic, exploiting the frequent network connections generated by an AI-assisted IDE to mask C2 communications. The active operator on the machine, a DevOps engineer, unwittingly provided the operational cover needed.

FLATROOF — also known as macOS.Gaslight — is an ARM64 backdoor written in Rust that executes shell commands and exfiltrates files via the Telegram Bot API, with polling and AES-GCM encryption over TLS with certificate pinning. The authentication token is self-redacted in runtime output to prevent recovery from logs or crash dumps. Persistence is achieved via a LaunchAgent labeled com.apple.system.services.activity. FLATROOF also removes the com.apple.quarantine attribute from ROOFDECK to bypass Gatekeeper, enabling execution of the second implant.

Post-Disclosure Reaction: Real-Time Anti-Forensics

On April 20, 2026 — a single day after the public disclosure of the LayerZero attack by the victim — a significant action occurred on the Indian endpoint. ROOFDECK downloaded a third-stage payload named loginwindow and deleted both original implants with rm -f. The timing suggests the actor monitored the previous victim's public communications and triggered a standardized withdrawal procedure.

SentinelOne interprets this pattern as indicative of an operation halted for "insufficient value." According to the analysis: "Our investigation revealed insights into what happens when this threat actor compromises a smaller organization that we believe ultimately yielded insufficient value to sustain the intrusion." This is an analyst assessment, not explicit actor confirmation.

The brief does not specify whether the loginwindow payload exfiltrated data before the last observed beacon on June 1, 2026. It also remains unverifiable how the backdoors initially arrived on the machine on March 18: telemetry records on-disk presence, not the entry vector at that precise moment.

"the value of the target is whatever their laptop can reach" — SentinelOne, on DevOps targeting logic

Why It Matters

The case documented by SentinelOne presents three significant limits for operational reading. The dossier does not specify the exact nature of data potentially exposed during the compromise window. It does not document specific remedial measures adopted by the victim. It also does not provide the total number of organizations hit beyond LayerZero and the Indian IT firm.

What emerges clearly is the risk profile: the DevOps engineer has become an autonomous attack surface, independent of the asset value of the employing company. Infrastructure automation tools — Terraform, provider registries, lock files — function as bridges to cloud environments that can exceed the single endpoint's exposed surface by orders of magnitude. The conditioning of beaconing on Cursor use indicates actors are mapping developer habits with increasing granularity, making it harder to separate legitimate activity from malicious communication.

The anti-forensics documented on April 20, 2026 further shows that TraderTraitor retains the ability to react to public events with response times measured in hours, not days. This operational reactivity is a relevant contextual datum for anyone evaluating the resilience of their detection controls.

Frequently Asked Questions

Are FLATROOF and ROOFDECK new or previously known backdoors?

They are previously documented backdoors. SentinelOne observed them in the LayerZero attack; the same family, FLATROOF (aka macOS.Gaslight), had been analyzed earlier on a VirusTotal sample. This is not novel code but confirmed instrumental reuse via identical hashes.

Why was beaconing tied to the Cursor IDE?

The dossier documents that the backdoors activated only with Cursor running. This behavioral gating allows malicious traffic to blend with typical IDE network connections, reducing visibility for monitoring systems. The source does not specify whether Cursor was chosen for its prevalence or for particular technical characteristics.

Was the Indian company targeted because it is an IT firm?

No. The targeted profiles were individuals with DevOps skills or experience in crypto/FinTech projects, not IT companies as a whole. The case appears opportunistic rather than sector-targeted. SentinelOne emphasizes the victim was "much smaller" than LayerZero and that the intrusion was abandoned.

Sources

• https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
• https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/
• https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/

Information is based on the cited source and current as of publication.

Sources