Hackers Linked to North Korea Weaponize Fake Terraform Interviews to Breach macOS Environments

North Korean cyber operators are leveraging fraudulent Terraform-based recruitment assignments to compromise macOS developers and gain access to cloud infrastructure. The campaign demonstrates how what appears to be a legitimate technical assessment can quickly evolve into a pathway for credential theft, persistent remote access, and broader enterprise compromise.

Security researchers have linked the activity to TraderTraitor, a financially motivated subgroup of the Lazarus threat ecosystem that is also tracked under the names UNC4899, PUKCHONG, and Jade Sleet.

The operation surfaced following the high-profile compromise of LayerZero, while investigators also uncovered an unrelated intrusion affecting an Indian IT services company. According to findings shared with Cyber Security News by SentinelLABS, the threat actors have broadened their targeting strategy beyond cryptocurrency organizations.

The campaign highlights North Korea's continued focus on individuals with privileged technical access, including software developers, DevOps engineers, and cloud administrators. Rather than targeting a specific company, the attackers are pursuing employees whose systems serve as gateways into valuable corporate environments.

Developer workstations are particularly attractive targets because they often contain cloud credentials, source code repositories, deployment permissions, API keys, and access to critical infrastructure. As a result, a single compromised endpoint can provide attackers with a direct route into enterprise networks and cloud platforms.

The approach mirrors previous Lazarus recruitment-themed operations, where threat actors exploit trust established through seemingly legitimate hiring processes and technical interviews.

Fake Terraform Assignments Used as Malware Delivery Mechanism

In the latest campaign, TraderTraitor operatives contacted job applicants with infrastructure-focused coding tests hosted in GitHub repositories. Targets were carefully selected based on public profiles indicating experience in DevOps, cryptocurrency, or financial technology sectors, allowing the attackers to create highly convincing project lures aligned with the victim's expertise.

Researchers discovered malicious repositories using names such as Northwind-IAC, novacart-interview, and terraform-candidate-repo.

Each repository included a tampered .terraform.lock.hcl file that redirected Terraform operations to an attacker-controlled provider registry instead of the legitimate Terraform registry. When victims executed the commonly used terraform init command, the malicious provider package was automatically downloaded and executed.

The technique is particularly deceptive because Terraform lock files are generally viewed as routine project metadata and often receive little scrutiny during code reviews. In one instance, a cautious candidate detected a suspicious provider dependency and removed it before execution, successfully preventing compromise.

Interview task from a GitHub repository containing a weaponized .terraform.lock.hcl file (Source – SentinelLABS)

This attack method underscores the growing risks associated with malicious infrastructure packages and poisoned software dependencies. Once initial access was established, the attackers deployed two macOS backdoors known as FLATROOF and ROOFDECK.

During the earlier LayerZero compromise, these malware families were used to harvest API keys and facilitate privilege escalation into both Amazon Web Services (AWS) and Google Cloud Platform (GCP) environments. The operation therefore targets not only developer endpoints but also the cloud resources connected to them.

Advanced macOS Backdoors Enable Persistent Access

In the intrusion involving the Indian IT services provider, attackers successfully compromised an Apple Silicon MacBook belonging to a DevOps engineer. The system was regularly used to manage infrastructure across AWS, OVH, and OpenStack environments, giving the attackers potential access to cloud credentials and source-control systems.

Forensic analysis revealed that both malware implants had been present on the device since March 18, with operational activity beginning on March 29.

FLATROOF, disguised as a process named SystemUpdate, functioned as an initial access and information-gathering tool. Its capabilities included:

• Executing shell commands
• Uploading files via Telegram
• Collecting browser-stored information
• Harvesting terminal command histories
• Enumerating installed applications
• Monitoring running processes
• Profiling system configurations
• Copying macOS login keychains

The malware's functionality aligns with prior investigations that identified FLATROOF as a Rust-based macOS backdoor designed primarily for intelligence gathering and credential theft.

The second implant, ROOFDECK, masqueraded as iSync and provided attackers with more extensive control over compromised systems. It could:

• Search for valuable files and documents
• Execute remote commands
• Create encrypted archives
• Exfiltrate stolen data
• Read clipboard contents
• Establish persistence through LaunchAgent mechanisms

ROOFDECK also leveraged the decentralized Nostr network to locate command-and-control infrastructure, making communications more resilient and harder to disrupt.

Weaponized .terraform.lock.hcl file (Source – SentinelLABS)

As the intrusion progressed, attackers introduced a stripped-down ROOFDECK variant named loginwindow, removed the earlier implants, and continued communicating with infected systems through June 1. This transition demonstrates the group's ability to rotate tools during active operations, minimize forensic evidence, and maintain long-term persistence.

The tactic reflects a broader trend in North Korean cyber campaigns targeting developers, similar to previous operations that abused Git workflows and malicious hooks to spread malware.

Defensive Recommendations

Organizations should consider employees with cloud administration, DevOps, and source-control privileges as a high-priority monitoring group. Security teams should investigate:

• Unsigned applications executing from user home directories
• Unusual child processes spawned by development tools
• Unexpected encrypted outbound network connections
• Suspicious GitHub interview repositories or coding assessments
• Unauthorized access to cloud credentials and API keys

Developers should avoid running external coding assignments on corporate systems and should carefully inspect Terraform project files before execution.

Particular attention should be paid to provider references within .terraform.lock.hcl files. Any provider that does not originate from the trusted registry.terraform.io namespace should be treated as suspicious and investigated immediately. Even packages hosted through official registries should be verified against their source code, publisher reputation, and supply-chain integrity before being deployed in production or development environments.