GCVE-110-OSM-2026-14675

TraderTraitor (DPRK) fake job-interview Terraform coding challenge; README instructs use of the malicious registry.hashicorp-aws.io provider. Running terraform init installs the FLATROOF and ROOFDECK macOS backdoors. === Delivery: weaponized .terraform.lock.hcl === Fake provider registries: registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io Behavior: `terraform init` fetches and executes a trojanized provider that drops FLATROOF and ROOFDECK. === FLATROOF (macOS.Gaslight) === Binary: ~/Library/com.apple.iTunesCloud/SystemUpdate (SHA1 02df07a173ab03b82a4fb6a08973fff8b1467f28) Lock file: $TMPDIR/tmp*.lock C2: technicais.sytes.net (176.97.114.232) Behavior: Rust backdoor; strips Gatekeeper quarantine from ROOFDECK, runs shell commands, harvests browser data, keychain files and shell histories over Telegram. === ROOFDECK === Binary: ~/Library/com.apple.internal.ck/iSync (SHA1 c491d477dbe0ae04e9aed9dbe237144c03f73ec4) Stripped variant: ~/Library/com.apple.appleaccountd/loginwindow (SHA1 5728b11d30586bbfc1d8bd12df1c722a06e767a2) IPC pipe: /private/tmp/.pipe-airway; config: $HOME/.config/.repl_history Persistence: ~/Library/LaunchAgents/*.plist (Label com.*, ProgramArguments --type=renderer, RunAtLoad) C2: storage.hubpage.cloud (45.11.59.140), grenight.com (85.137.56.245); staging 85.137.56.10; HTTPS tasking endpoint /app_version Custom TLS cert (mkcert, CN=mkcert ub@ub-Standard-PC-Q35-ICH9-2009) SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa, SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82, serial 1cd6d13ff15adbf7a42025d10ec99b4a Behavior: Rust backdoor; resolves C2 via an operator Nostr profile, signed+encrypted tasking, reverse shell, wallet/key search, clipboard read/replace.