SentinelOne Labs (Albert Priego, Alex Delamotte, Matej Havranek; 18 September 2026) documents a further victim of North Korean TraderTraitor / Jade Sleet (also PUKCHONG, Slow Pisces, UNC4899) after the April 2026 LayerZero / KelpDAO theft disclosure. Primary: an India-based IT services provider (not crypto-affiliated) compromised via an Apple Silicon DevOps engineer’s MacBook holding Terraform/Ansible reach into AWS, OVH and OpenStack plus source-control credentials.

Same macOS ARM64 Rust backdoors as LayerZero: FLATROOF (aka macOS.Gaslight; on-disk appearance as SystemUpdate under ~/Library/com.apple.iTunesCloud/) and ROOFDECK (as iSync under ~/Library/com.apple.internal.ck/). Telemetry: both implants on disk from 18 March 2026, dormant until 29 March when Cursor launched them seconds after opening a cloudshield workspace; FLATROOF strips Gatekeeper quarantine from ROOFDECK before exec.

Initial access pattern across the campaign wave: Contagious Interview–style job lures via GitHub coding projects with weaponised .terraform.lock.hcl pointing at attacker “HashiCorp” provider domains (registry.hashicorp-aws[.]com / .io / registry.hashicorp-terraform[.]io) so terraform init pulls malicious modules. Distinct from desk card acsc-waterplum-contagious-interview-20260918 (WaterPlum / Contagious Interview joint advisory) — overlapping lure tradecraft, different DPRK cluster and tooling.

Amplify: The Hacker News 21 September 2026. No CVE.

UPDATE (8 Oct): Zscaler ThreatLabz published its analysis of the same campaign, first seen in July 2026. A Go binary named terraform-provider-awsbeta_v1.0.0 works as a real-looking AWS provider for HashiCorp Terraform, but an added package runs as soon as Terraform loads it: it uses a session.lock file in the temp folder as a run-once marker and fetches a Bash loader (safari_updater) from the lookalike domain hashicorp-terraform[.]io.

The loader picks a payload for macOS, Linux or Windows (Cygwin/MinGW/MSYS), downloads it disguised as a .woff font file from a dynamic DNS host, a GitHub repository or a Vercel site, decrypts it with AES-256-CBC, strips the macOS quarantine flag and runs FLATROOF, which steals data and then drops the ROOFDECK backdoor.

Zscaler links the activity to TraderTraitor and the KelpDAO incident but says its attribution confidence is not high. How the provider reached victims is unknown. Check Terraform plugin caches and .terraform.lock.hcl files for awsbeta or non-HashiCorp registry hosts.