KelpDAO: Trojanized Terraform Provider Delivers Cross-Platform Malware to Steal Developer Credentials

North Korean APT Group Targets Dev Workstations with Trojanized Terraform Provider

In July 2026, Zscaler ThreatLabz uncovered a sophisticated malware campaign leveraging a trojanized Terraform provider to compromise developer workstations and CI/CD systems. The activity exhibits strong overlaps with TraderTraitor (also known as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), a North Korean state-backed threat group previously linked to the KelpDAO incident. While attribution lacks unique forensic ties, the tactics, techniques, and procedures (TTPs) align closely with the group’s known operations.

Attack Chain: Malicious Terraform Provider

The initial payload is a Go-based binary disguised as terraform-provider-awsbeta_v1.0.0, mimicking a legitimate AWS Terraform provider. Upon execution, the malware:

• Checks for a session.lock file in the temp directory to ensure single execution.
• Downloads a Bash script (safari_updater) from the lookalike domain hashicorp-terraform[.]io.
• Executes the script in a detached process while maintaining normal provider functionality to evade detection.

Multi-Platform Loader & Payload Delivery

The Bash loader supports macOS, Linux, and Windows (via Cygwin, MinGW, or MSYS), dynamically generating filenames based on OS and CPU architecture. For example:

• Linux: NotoSansCJK-Regular.woff
• macOS: HiraginoSans-Bold.woff
• Windows: MalgunGothic-ExtraBold.woff

The loader fetches encrypted payloads from dynamic DNS hosts, GitHub repositories, or Vercel sites, using decoy font files (.woff) to conceal malicious executables. After Base64 decoding and AES-256-CBC decryption, the payload FLATROOF, a Rust-based backdoor is deployed.

FLATROOF Backdoor Capabilities

FLATROOF operates across all three platforms, using PBKDF2-HMAC-SHA256 and AES-256-GCM for configuration decryption. Key features include:

• Three C2 channels: Telegram Bot API, GitHub API polling, and HTTP webhooks.
• Persistence mechanisms:
  • Linux: Systemd service
  • macOS: zlogout script
  • Windows: Registry Run key
• Data theft:
  • Browser credentials (Chromium, Firefox, Safari)
  • Cryptocurrency wallets (MetaMask, Phantom, Trust Wallet, Rabby)
  • OS-specific secrets (macOS Keychain, Linux keyring, Windows Credential Manager)
  • Shell history, installed apps, and running processes
• Windows-specific injection: Decrypts and injects an XOR-encoded payload into a suspended Chromium process to extract browser master keys.

Final Stage: ROOFDECK

The attack culminates in ROOFDECK, a secondary payload observed on Windows and macOS. It resolves C2 addresses through a three-layer fallback system:

1. Local configuration file
2. Encrypted, RSA-signed Pastebin URL (hxxps://pastebin[.]com/raw/3yptBDhL)
3. Nostr profile metadata (if Pastebin fails)

ROOFDECK communicates via HTTP/WebSocket, enabling:

• Reverse shell access
• File operations
• Clipboard monitoring
• Persistence control
• Self-destruction

Indicators of Compromise (IoCs)

• Domains:
  • hashicorp-terraform[.]io
  • arusupport-region1-webhook[.]online
  • supportaru.serveftp[.]com
  • delay.servehttp[.]com
• Hashes (MD5):
  • 9d78ece09457907b730d139e4e0c64dd (trojanized provider)
  • 73adaea97f003735335505858c1c6def (safari_updater)
  • 2b81aceab0142472d94eb42e500b27b1 (macOS ROOFDECK)

Zscaler detects the malware as OSX.Backdoor.FLATROOF and OSX.Backdoor.ROOFDECK. The campaign underscores the risks of untrusted Terraform providers and the need for vigilance in developer environments.

Source: https://cyberpress.org/terraform-provider-malware/

KernelDAO cybersecurity rating report: https://www.rankiteo.com/company/kernel-dao

"id": "KER1791815478",
"linkid": "kernel-dao",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology, Software Development',
                        'type': 'Developer workstations, CI/CD systems'}],
 'attack_vector': 'Trojanized Terraform Provider',
 'data_breach': {'data_encryption': 'AES-256-CBC, AES-256-GCM',
                 'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Browser credentials',
                                              'Cryptocurrency wallets',
                                              'OS-specific secrets',
                                              'Shell history',
                                              'Installed applications',
                                              'Running processes']},
 'date_detected': '2026-07',
 'date_publicly_disclosed': '2026-07',
 'description': 'In July 2026, Zscaler ThreatLabz uncovered a sophisticated '
                'malware campaign leveraging a trojanized Terraform provider '
                'to compromise developer workstations and CI/CD systems. The '
                'activity exhibits strong overlaps with TraderTraitor (also '
                'known as Jade Sleet, UNC4899, Pressure Chollima, and Slow '
                'Pisces), a North Korean state-backed threat group previously '
                'linked to the KelpDAO incident. The attack involved a '
                'Go-based binary disguised as a legitimate AWS Terraform '
                'provider, which deployed multi-platform loaders and backdoors '
                '(FLATROOF and ROOFDECK) to steal sensitive data, including '
                'browser credentials, cryptocurrency wallets, and OS-specific '
                'secrets.',
 'impact': {'data_compromised': 'Browser credentials, cryptocurrency wallets, '
                                'OS-specific secrets, shell history, installed '
                                'apps, running processes, personally '
                                'identifiable information',
            'identity_theft_risk': 'High',
            'operational_impact': 'Compromised development environments, '
                                  'potential supply chain risks',
            'systems_affected': 'Developer workstations, CI/CD systems'},
 'initial_access_broker': {'backdoors_established': 'FLATROOF, ROOFDECK',
                           'entry_point': 'Trojanized Terraform provider',
                           'high_value_targets': 'Developer workstations, '
                                                 'CI/CD systems'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Risks of untrusted Terraform providers, need for '
                    'vigilance in developer environments, importance of '
                    'monitoring for multi-platform malware loaders.',
 'motivation': 'State-backed cyber espionage, data theft, financial gain',
 'post_incident_analysis': {'corrective_actions': 'Implement strict '
                                                  'verification processes for '
                                                  'third-party tools, enhance '
                                                  'monitoring for '
                                                  'multi-platform malware, and '
                                                  'conduct regular security '
                                                  'audits of development '
                                                  'environments.',
                            'root_causes': 'Use of untrusted Terraform '
                                           'provider, lack of verification for '
                                           'third-party dependencies, '
                                           'insufficient monitoring of '
                                           'developer environments.'},
 'ransomware': {'data_encryption': 'Yes', 'data_exfiltration': 'Yes'},
 'recommendations': 'Verify the authenticity of Terraform providers, implement '
                    'enhanced monitoring for developer workstations, restrict '
                    'access to dynamic DNS hosts and untrusted repositories, '
                    'and deploy endpoint detection and response (EDR) '
                    'solutions.',
 'references': [{'date_accessed': '2026-07', 'source': 'Zscaler ThreatLabz'}],
 'response': {'third_party_assistance': 'Zscaler ThreatLabz'},
 'threat_actor': ['TraderTraitor',
                  'Jade Sleet',
                  'UNC4899',
                  'Pressure Chollima',
                  'Slow Pisces'],
 'title': 'North Korean APT Group Targets Dev Workstations with Trojanized '
          'Terraform Provider',
 'type': 'Malware Campaign'}