A routine Terraform command is becoming an entry point for North Korean hackers targeting developers. TraderTraitor, a DPRK-linked threat actor, is using weaponized infrastructure projects disguised as job interview assignments, with malicious providers that can execute when a candidate runs terraform init.
SentinelOne also found the group’s FLATROOF and ROOFDECK macOS backdoors on an Apple Silicon Mac used by a DevOps engineer at an India-based IT services provider with no cryptocurrency ties. The affected machine held cloud credentials and source-control access and was regularly used with AWS, OVH, and OpenStack, giving the attackers a potential path beyond the endpoint.
According to SentinelOne’s Sept. 18 investigation, both backdoors were already on the Mac by March 18, 2026, and began beaconing on March 29 after Cursor opened a cloudshield workspace. The developer did not clone the identified terraform-candidate-repo until April 13, so researchers could not tie the original infection to the Terraform lure.
Terraform lures hide malicious providers
TraderTraitor’s fake interview repositories resemble infrastructure-engineering assessments. SentinelOne found weaponized .terraform.lock.hcl files that direct Terraform to attacker-controlled provider domains designed to resemble legitimate HashiCorp infrastructure.
When a developer runs terraform init, Terraform can download and execute code from the malicious provider specified by the project. The technique does not exploit a Terraform vulnerability; it abuses normal dependency handling and trust in recruiter-supplied code.
A separate September incident showed how a compromised registry could distribute malicious Terraform modules that searched developer environments for cloud, CI/CD, SSH, and other credentials. Developer tools and automation can also hold privileged access to source code, credentials, and deployment systems.
FLATROOF can execute shell commands and collect browser data, terminal histories, system information, and a copy of login.keychain-db. ROOFDECK adds reconnaissance, remote-shell access, file operations, persistence, and capabilities that can support lateral movement.
The FBI attributed the approximately $1.5 billion theft from Bybit in February 2025 to North Korean activity it tracks under the TraderTraitor designation.
Cutting off the developer-to-cloud attack path
Organizations should treat recruiter-supplied repositories and coding exercises as untrusted code, especially on systems that can reach cloud infrastructure, source repositories, or CI/CD platforms.
- Isolate unfamiliar coding assignments. Run interview projects in disposable virtual machines or sandboxes instead of corporate workstations; Microsoft recommends isolated environments for unfamiliar coding tests.
- Verify dependencies before execution. Review lock files, provider sources, registry domains, repository tasks, and unexpected setup commands before running unfamiliar projects.
- Reduce credential exposure. Apply least privilege and short-lived access to cloud, source-control, CI/CD, and administrative systems. The recent Shai-Hulud npm supply-chain compromise shows how compromised developer workflows can expose credentials across multiple services.
- Monitor developer endpoints. Alert on IDEs spawning shells, unexpected binaries, new Launch Agents, suspicious outbound connections, and unusual cloud or repository access.
- Segment engineering systems and restrict egress. CISA software supply chain guidance recommends segregating engineering networks, minimizing service accounts, and logging build-pipeline access.
- Test incident response plans. Exercises should cover malicious repositories, stolen cloud credentials, persistence, and lateral movement, including endpoint isolation, session revocation, credential rotation, log review, and threat hunting.
The Indian victim’s initial infection vector remains unknown, but developer workstations can provide access far beyond the endpoint itself. Isolation, tighter privileges, monitoring, and tested response procedures can limit that exposure.
Also read: Development environments remain high-value targets after initial access; the recent Accenture breach shows how source code and cloud credentials can create security risk long after the first compromise.