North Korean TraderTraitor Targets Devs With Malicious Terraform Provider Dropping FLATROOF, ROOFDECK
North Korean-linked actors used a malicious Terraform provider to drop FLATROOF and ROOFDECK malware on developer systems in July 2026.
Key points
- Zscaler ThreatLabz identified a trojanized Terraform provider used in a July 2026 campaign.
- The attack delivers FLATROOF for data theft and ROOFDECK for remote access control.
- The threat actor is suspected to be TraderTraitor, a North Korean state-backed group.
Zscaler ThreatLabz reported in July 2026 that the suspected TraderTraitor group deployed a trojanized Terraform provider to infect developer environments. This supply chain attack vector allows malicious code to execute immediately when Terraform loads the compromised provider, bypassing standard execution checks.
Root cause
The compromise stems from a malicious provider binary that mimics legitimate HashiCorp software. According to Zscaler, the trojanized component preserves normal Terraform functionality to avoid detection while quietly initiating a download routine. This design ensures the infrastructure-as-code tool continues to operate for the user, masking the underlying malicious activity.
Attack path
The compromised provider contacts a lookalike domain themed around HashiCorp to retrieve a Bash loader. This loader acts as a cross-platform dispatcher, selecting specific payloads based on the victim’s operating system and CPU architecture. It subsequently installs FLATROOF, which uses Python scripts to steal sensitive data, before dropping the ROOFDECK backdoor for persistent remote control.
Affected versions
The source material does not specify which versions of Terraform are vulnerable to this supply chain injection. The attack relies on the user downloading and using the specific trojanized provider binary rather than exploiting a software bug in the core Terraform application. Any environment using this specific malicious provider binary is considered affected.
Mitigation
- Verify the cryptographic signature of all Terraform providers before installation.
- Monitor for outbound connections to non-standard or lookalike domains from build servers.
- Isolate systems exhibiting unusual Python script execution or unknown backdoor processes.
- Review Terraform plugin directories for unexpected or unauthorized binary files.
Background: Supply chain attacks
Supply chain attacks in cyber security exploit the trust you place in third-party software components. Attackers inject malicious code into legitimate updates or build pipelines. You receive the payload as if it were benign. Defending requires verifying code origins, isolating build environments and treating all external inputs as hostile.
Read the full guide: Supply chain attacks in cyber security: how they work and how to stop them
What to do and how to stay safe: Terraform
- Audit your Terraform plugin directories for any binaries that lack valid vendor signatures.
- Implement network monitoring to detect connections to domains mimicking official vendor URLs.
- Restrict outbound internet access for build agents to only necessary repositories.
- Once the vendor provides an update, ensure all infrastructure-as-code tools are patched immediately.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is behind the TraderTraitor campaign?
Zscaler attributes the activity to TraderTraitor, a North Korean government-backed advanced persistent threat group also known as Jade Sleet and UNC4899.
What malware is delivered in this attack?
The campaign delivers FLATROOF for initial credential theft and data exfiltration, followed by the ROOFDECK backdoor for broader remote control of the system.
Is there a confirmed patch for this issue?
No specific patch for the Terraform software itself is mentioned, as this is a supply chain attack involving a malicious provider binary rather than a software vulnerability.
