Binance heist: what we know, and what RL sees in TraderTraitor's toolkit

Spectra Assure Free Trial Get your 14-day free trial of Spectra Assure for Software Supply Chain Security Get Free TrialMore about Spectra Assure Free TrialUpdated November 4, 2026 On October 29, 2026, attackers stole approximately $6.34 billion in digital assets from Binance in one of the largest cryptocurrency thefts on record. Since our initial analysis, two significant developments have clarified how the attack unfolded. On October 31, the FBI formally attributed the theft to North Korea's TraderTraitor operation. On November 3, Binance released its initial incident findings, revealing a multi-stage compromise involving malicious software delivered through a fake job interview, compromised developer systems, and the abuse of internal wallet infrastructure. The new findings reinforce a growing concern for security teams: attackers are increasingly targeting trusted developer tools and environments to gain access to critical systems. That is where ReversingLabs' original research provides additional insight. Our analysis of TraderTraitor's broader malware toolkit uncovered malicious components in ReversingLabs telemetry 77 days before public disclosure, identified backdoor variants with earlier submission histories, and revealed how malicious code can hide within otherwise legitimate developer software. While ReversingLabs has not established a direct connection between the malware samples examined here and the Binance compromise, our findings offer additional intelligence into the techniques, tooling, and detection challenges associated with TraderTraitor activity. Binance's November 3 incident report describes a sophisticated, multi-stage campaign that extended over several months: The attack demonstrates how a developer-focused social engineering campaign can progress into a compromise of business-critical infrastructure. Binance has since rebuilt affected systems, replaced compromised devices, revoked exposed credentials, and strengthened its security controls. Its investigation and independent review remain ongoing. On-chain mechanics. TRM Labs, Elliptic and Cointegrity have published consistent accounts of how the funds moved. RL has not independently verified them. The points that matter for defenders: On nine of the ten chains, funds left through ordinary signed transfers, which fits Binance's statement that no keys leaked. We assess with moderate confidence, consistent with TRM's reading, that the attacker controlled the path that requests signatures rather than the keys themselves. Preparing 50 authorizations across consecutive nonces suggests time-limited access to that path, or signing through a system the attacker did not fully own. Attribution: On October 31, 2026, the FBI officially attributed the Binance theft to North Korea's TraderTraitor operation, confirming earlier assessments from blockchain intelligence firms, including TRM Labs and Chainalysis. This establishes government attribution for the attack. However, attribution of the broader intrusion does not establish that any particular malware sample identified in ReversingLabs' historical telemetry was deployed against Binance. Our analysis therefore distinguishes the confirmed incident attribution from the separate technical findings involving TraderTraitor's previously documented developer-targeted malware. Source | Date | What it says | Basis given | |---|---|---|---| Oct 30, 2026 | TraderTraitor, high confidence | On-chain and off-chain intelligence; Tornado Cash-funded operator wallet, staging and rehearsal, pre-obtained signatures fired in one burst, matching Bybit (2025) and KelpDAO (2026) | | Chainalysis, via The Hacker News and Forbes | Oct 30, 2026 | "A high degree of confidence that DPRK is responsible"; CEO Jonathan Levin names TraderTraitor as likely | Binance proceeds commingled with funds from the September 2026 Bitget exploit | The precedent comes from government attribution of earlier thefts: the FBI attributed the February 2025 Bybit theft to TraderTraitor, and the FBI, Japan's NPA and the DC3 attributed the 2024 DMM Bitcoin theft to the same group. The address that received both Binance and Bitget proceeds, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, is the most specific shared artifact published so far. TraderTraitor, also tracked as Jade Sleet, UNC4899, Slow Pisces and Pressure Chollima, is a financially motivated North Korean cluster within the broader Lazarus umbrella. Its access pattern is consistent across cases: a social-engineering lure aimed at an engineer, malware on that engineer's workstation, theft of session material or credentials, then abuse of the victim's own transaction approval process. In the Bybit case, the entry point was a Safe{Wallet} developer's macOS machine. Despite the additional disclosures, several important questions remain: Binance has provided technical details about the malicious development-tool replacement used in the attack, but a complete public account of the malware and its infrastructure remains unavailable. Binance's findings confirm the role of malicious developer software in the intrusion. But they also raise a broader question: how early can defenders identify malicious code when it is embedded in software that otherwise appears legitimate? ReversingLabs' analysis provides a valuable perspective. Our telemetry captured a trojanized Terraform provider 77 days before it was publicly documented. The malicious binary appeared alongside 16 legitimate provider builds, demonstrating how difficult it can be to distinguish compromised software using conventional similarity and reputation signals alone. Further analysis uncovered likely earlier variants of the ROOFDECK backdoor and identified malware operating under generic threat classifications that would not necessarily surface in searches for TraderTraitor. These findings are not evidence that the specific samples were used against Binance. They are independent insights into the broader threat landscape and the challenges defenders face when investigating sophisticated software supply chain attacks. On October 8, 2026, Zscaler ThreatLabz published research on a campaign it attributes, with stated caution, to TraderTraitor. It uses a trojanized Terraform AWS provider to infect DevOps engineers. SlowMist separately reported weaponized .terraform.lock.hcl files in fake-interview repositories that pull the malicious provider when the victim runs terraform init, and HivePro published an advisory with additional hashes, domains and IPs. RL researchers looked up every published file and network indicator in Spectra Intelligence, ran similarity (RHA) pivots on each sample RL holds, and queried the RL data warehouse for submission history, scanner coverage and ATT&CK mappings produced by Spectra Core. Classifications, threat names and scanner counts come from the Spectra Intelligence File Reputation API (TCA-0101), cross-checked against the warehouse. The summary tiles in the figures show Spectra Analyze's "community threat detections" count, which runs one or two lower. RL first saw terraform-provider-awsbeta_v1.0.0 (SHA-1 8473f85bda00dfa3...) on July 23, 2026, at 01:06 UTC, 77 days before the public write-up. RL classifies it as malicious, threat name MacOS.Trojan.Multiverze. It is a 17.5 MB 64-bit Mach-O built from Go. RHA, RL's functional similarity hash, places it in a cluster of 17 Mach-O files first seen between March and October 2026. Sixteen are goodware, legitimate Terraform AWS provider builds. The malicious provider looks almost identical to the real thing because it is the real thing, with a small malicious package compiled in that runs when Terraform loads the plugin. Figure 1. RHA similarity results for the trojanized provider in Spectra Analyze. Note that one malicious sample sits among 16 goodware provider builds; similarity alone cannot separate them. Anything that judges a binary by its overall structure, including fuzzy-hash allow-listing, will tend to wave this file through, and 7 of 24 scanners in RL's multi-scanner records flag it. Per Zscaler, the provider checks for a run-once marker (session.lock), downloads a Bash script from diagnose[.]hashicorp-terraform[.]io, saves it as safari_updater, runs it detached, and then works as a normal provider so terraform plan and apply behave as expected. Twelve minutes later, safari_updater (SHA-1 d81081691c3631f3...) arrived. The 5.6 KB shell script is suspicious under the generic name MacOS.Trojan.Generic, with 11 of 24 scanners detecting it. It picks a payload by operating system and CPU architecture, each hidden in a file named like a font: decoy WOFF data, an @@ENDFONT@@ marker, then a Base64-encoded, AES-256-CBC-encrypted executable. Zscaler published eight container hashes. RL holds one, the macOS ARM64 HiraginoSans-Regular.woff (SHA-1 4402e44c0bc959ac...), which arrived a minute after the loader and carries a suspicious verdict under the family-specific name MacOS.Trojan.Flatroof. The other seven are absent from RL's repository. Here's what you need to know: the stage that carries the actual backdoor is the stage least likely to be shared, scanned or retained, which makes the network and behavioral indicators below more important than the hashes. Figure 2. Spectra Analyze record for the FLATROOF font container. Note the WOFF file type and the suspicious classification despite the file presenting as a font. Inside the loader. RL downloaded both files from Spectra Analyze and read the script. It tries three base URLs in order: hxxps://https://supportaru[.]serveftp[.]com/statics/cache/v11, then a GitHub mirror under hxxps://raw[.]githubusercontent[.]com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/, then hxxps://stage-fashion365[.]vercel[.]app/static/tinymce4.7.5/plugins/fonts/v1104. The primary entry carries a doubled scheme, https://https://, exactly as shown, so that request cannot succeed as written and every run of this build falls through to the GitHub mirror. We read this as a likely operator error. The font family encodes the operating system (NotoSansCJK for Linux, HiraginoSans for macOS, MalgunGothic for Windows) and the style encodes the CPU (Bold for x86_64, Regular for arm64, ExtraBold for armv7 or armv6, Italic for i386). Decryption is grep -a -b -o for the marker, then openssl enc -d -aes-256-cbc -md md5 -base64 -A with the hardcoded passphrase PTa3WZPQZAjj55t@. That is OpenSSL's legacy EVP_BytesToKey derivation with MD5, so the Base64 blob in every container built this way starts with U2FsdGVkX1, the encoding of Salted__. The key is in the script. Nothing else is needed to decrypt a container. Output is written through python3, node, perl or openssl, in that order. The payload lands at $HOME/.config/git/update on Linux, $HOME/Library/com.apple.iTunesCloud/SystemUpdate on macOS or $HOME/AppData/Local/Microsoft/Edge/service.exe on Windows. On macOS the loader strips com.apple.quarantine with xattr and ad-hoc signs the file with codesign -s -. It launches the payload detached with the argument --type=renderer, so a process listing shows what looks like a Chromium renderer. The self-delete line, rm -- "$0", is commented out. The script stays on disk. The decrypted payload. We applied the same split-and-decrypt logic to the RL-held container in an isolated scratch environment and never executed the output. The result is a 2,295,744-byte Mach-O 64-bit arm64 executable written in Rust, with Rust crate paths under /Users/dev/.cargo/, Telegram error strings and a "~/.zlogout created by script" marker, all consistent with Zscaler's description of FLATROOF. Spectra Intelligence already held it (SHA-256 3c254614de8c1a2f...), classified malicious under the name MacOS.Trojan.Gaslight, flagged by 10 of 24 scanners and first seen at 01:17:59 UTC on July 23, 2026, inside the same submission window as the provider, the loader and the container. That is a fourth RL family name for the toolset, and none of them says TraderTraitor: Multiverze for the provider, Flatroof for the container, Gaslight for the decrypted FLATROOF and GetShell or ReverseShell for ROOFDECK. FLATROOF is a Rust backdoor that runs Python credential stealers and then installs a second backdoor, ROOFDECK. Zscaler published one macOS and one Windows ROOFDECK hash, and both are in RL's repository with a submission history worth noting. macOS ROOFDECK. The imagent sample (SHA-1 93c655963d7dd6ca...) was first seen by RL on July 23 at 01:18 UTC, in the same 13-minute window as the provider, loader and container. It is malicious, threat name MacOS.Backdoor.GetShell, flagged by 21 of 38 scanners. An RHA pivot found two more malicious macOS samples in the same cluster, both named MacOS.Exploit.ReverseShell: 20e541a41fc8b0e2..., first seen May 22, 2026, and 5728b11d30586bbf..., first seen July 13, 2026. Neither appears in the Zscaler or HivePro reports. Spectra Core maps both to the same ATT&CK techniques as the published sample, all three files are 4.7 MB, and their TLSH digests differ in at most four of 72 characters. We assess with high confidence that these are builds of the same program, and likely earlier ROOFDECK builds, which would put the macOS backdoor in circulation at least two months before the July discovery. The ROOFDECK name rests on Zscaler's identification of imagent; we have not reverse engineered the siblings. Windows ROOFDECK. update.exe (SHA-1 0b7ca6630ea1e66b...) was first seen by RL on September 9, 2025, ten months before the reported discovery. It is malicious, threat name Win64.Trojan.ReverseShell, and 14 of 23 scanners detect it. It was submitted under names such as RustyStealer_9d88b4494c7bc27b10358b68a899ad54.exe and 2025-09-09_9d88b4494c7bc27b10358b68a899ad54_akira_rusty-stealer, so in 2025 it was circulating as a generic Rust stealer that some submitters linked to Akira. Figure 3. Spectra Intelligence summary for Windows ROOFDECK. Note FIRST SEEN CLOUD 2025-09-09 03:57 UTC and the generic threat name Win64.Trojan.ReverseShell. On both platforms the backdoor was detected as malicious, but under generic names that gave no hint it belonged to a state actor's crypto-theft toolkit. RL found no sample carrying a TraderTraitor-specific threat name first seen between June 2025 and October 2026. Analysts searching their telemetry for "TraderTraitor" or "Lazarus" labels will not find this toolset. HivePro's advisory lists 11 SHA-256 hashes and a set of domains. RL holds all 11 files, all malicious, and all between four and six years old: RL first seen | Count | RL threat names | File types | |---|---|---|---| Oct 2020 to Jan 2021 | 8 | Win32.Trojan.Tradertraitor, Win64.Trojan.Tradertraitor, MacOS.Trojan.NukeSped, MacOS.Backdoor.NukeSped, MacOS.Trojan.NukSpedEnc | NSIS installers, DMG, Mach-O, PE | Oct 2021 to Apr 2022 | 3 | MacOS.Trojan.TraderTraitor | DMG, ZIP | These are AppleJeus-era trojanized crypto trading applications, legitimate historical TraderTraitor IOCs that do not belong to the 2026 campaign. The domains follow suit. Of 29 files RL has downloaded from five HivePro domains, 28 are goodware; the one malicious download came from technicais[.]sytes[.]net (MacOS.Backdoor.GetShell), and among the HivePro IPs, 176[.]97[.]114[.]232 (AS6698) is the only one from which RL holds a malicious download. Import the HivePro list as hunting context only. Pushing it to an enforcement blocklist will produce false positives and will not detect the 2026 toolset. Third-party detection of the 2026 network indicators is thin. Across RL's URL and domain reputation sources, the 2026 domains are flagged by between 0 and 5 of roughly 49 vendors, and the lookalike registry registry[.]hashicorp-terraform[.]io, the domain a weaponized lock file points at, has none, so a lock file that pins providers to a non-HashiCorp registry is a stronger signal than any reputation score. RL's URL records first saw hxxp://arusupport-region1-webhook[.]online/ on July 25, 2026, from a third-party source that flagged it as detected, 75 days before the Zscaler publication, and the hashicorp-terraform[.]io lookalikes first appear in those records on September 25, 2026. Indicator | Role | Vendors flagging | |---|---|---| diagnose[.]hashicorp-terraform[.]io | Bash loader download | 5/48 | registry[.]hashicorp-terraform[.]io | Lookalike registry | 0/49 | registry[.]hashicorp-aws[.]com | Lookalike registry | 2/50 | supportaru[.]serveftp[.]com | FLATROOF payload host | 2/49 | arusupport-region1-webhook[.]online | One timing coincidence needs stating. RL's index holds browser-profile artifacts that reference the FLATROOF hosts and were first seen on October 29 between 19:43 and 20:10 UTC, minutes before the first Binance outflow. RL warehouse data shows they were written by three Joe Sandbox URL analyses of the published Zscaler URLs, run on Linux with Firefox 112, each returning "no threats found" with no sample detonated, and the same URLs had been re-checked repeatedly since early October. We assess that routine re-analysis of public IOC URLs accounts for the timing. No victim produced these files, and they do not connect the toolkit to Binance. The chain below combines Zscaler's analysis with the samples RL holds. Stages marked [RL] are present in RL's repository. fake interview repo (.terraform.lock.hcl -> registry[.]hashicorp-terraform[.]io) └── terraform init └── terraform-provider-awsbeta_v1.0.0 [RL] malicious, MacOS.Trojan.Multiverze ├── writes session.lock (run-once marker) └── sh -c ./safari_updater & [RL] suspicious, MacOS.Trojan.Generic ├── curl .woff from supportaru[.]serveftp[.]com | GitHub | Vercel │ [RL] 1 of 8 containers, MacOS.Trojan.Flatroof ├── split at @@ENDFONT@@ -> base64 -d -> AES-256-CBC decrypt (openssl -md md5) ├── xattr -d com.apple.quarantine; codesign -s - (macOS) └── ~/Library/com.apple.iTunesCloud/SystemUpdate --type=renderer (FLATROOF, Rust) │ [RL] malicious, MacOS.Trojan.Gaslight (decrypted by RL) ├── persistence: ~/.zlogout hook (macOS) | snap-imagent service (Linux) │ | HKCU Run "powershell-config-service" (Windows) ├── Python stealers: browser cookies, logins, keychain, shell history │ -> collected_data.zip ├── C2: Telegram bot | GitHub API | hxxps://arusupport-region1-webhook[.]online └── ROOFDECK (imagent / update.exe) [RL] malicious, GetShell / ReverseShell └── C2 resolved via Nostr profile -> Pastebin (RSA-signed) -> delay[.]servehttp[.]com From an engineer's workstation, stolen browser sessions, cloud credentials and shell history give an operator authenticated access to internal systems without defeating MFA, which is the pattern TraderTraitor has used in every major case since DMM Bitcoin. Whether that is what happened at Binance is unknown. Binance's own description of the next step is a service container submitting withdrawals. All IOCs and indicators in this blog post can be found in our GitHub repository [LINK]. The following is a subset for reference. File indicators below are the 2026 Terraform toolset as present in RL, plus the two RHA siblings RL identified and the FLATROOF payload RL decrypted. None of these are published as Binance-specific IOCs. File indicators: SHA-256 | SHA-1 | MD5 | Description | |---|---|---|---| 188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666 | 8473f85bda00dfa3ecd2385dd38f69600d1d64a6 | 9d78ece09457907b730d139e4e0c64dd | terraform-provider-awsbeta_v1.0.0, trojanized provider, RL: MacOS.Trojan.Multiverze | 451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97 | d81081691c3631f3adc1a6db0ee22ab19682ef30 | 73adaea97f003735335505858c1c6def | safari_updater Bash loader, RL: MacOS.Trojan.Generic | 62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38 | 4402e44c0bc959ac22340041413de2482e8b5d53 | Zscaler-published font containers not present in RL (MD5): 116f7189ed7b41f1b339a749d56e63be, 58fa0d651898446d5f5d2ed8a27a3330, 2621753691be9521288664bb551dfba6, ad0b1b6d2c8b9d09d6473a4a299470ab, 4b8509cde757b5428e5f99c8dffe73ca, 3826dc7a9ba8bd5b1c143560c1530d89, 34a52e6a4d803e94fe497bab682abfd3. Network indicators (2026 toolset): Indicator | Type | Description | |---|---|---| registry[.]hashicorp-terraform[.]io | Domain | Lookalike Terraform registry referenced by weaponized lock files | registry[.]hashicorp-aws[.]com | Domain | Lookalike Terraform registry | diagnose[.]hashicorp-terraform[.]io | Domain | safari_updater download host | hxxps://diagnose[.]hashicorp-terraform[.]io/plugins/grpc/v6/schema/metrics/333afe63-c5a2-43f0-b046-7cbaa7797e8a | URL | Full URL on the loader download host, as published by Zscaler | On-chain indicators (Binance theft, from TRM Labs, Elliptic and Cointegrity; not RL-derived): Indicator | Type | Description | |---|---|---| 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 | ETH address | Operator / relayer wallet, Tornado Cash funded | 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b | ETH tx | Type-4 transaction with 50 EIP-7702 authorizations | 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 | ETH tx | Sweep of Binance 14 | 0x80358c5b8f9b2cc27147a1e0f2a6c9a30eb2c397 | Address | Avalanche receiver | The Source column distinguishes techniques Spectra Core mapped from the RL samples or RL's loader analysis ("RL"), techniques described in third-party analysis of the 2026 toolset ("3P"), and techniques that apply to the Binance incident by inference only ("Inferred"). Mapped against ATT&CK Enterprise at the time of writing. Technique | ID | Description | Source | |---|---|---|---| Phishing: Spearphishing via Service | T1566.003 | Recruiter or interview lure delivering a repository to the engineer | 3P; Inferred for Binance | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | T1195.001 | Malicious Terraform provider pulled by .terraform.lock.hcl | 3P | User Execution: Malicious File | T1204.002 | Engineer runs terraform init in the lure project | 3P | The EIP-7702 delegation abuse does not map cleanly to an existing ATT&CK technique. We describe it as protocol abuse following signing-path compromise. A Navigator layer JSON is available on request. The font container is the most distinctive artifact in the chain: a valid WOFF header followed by a text marker and a long Base64 blob, which legitimate fonts do not contain. The loader has to reference the same marker to split the file, so we pair the two. rule RL_TraderTraitor_FlatroofFontContainer_2026 { meta: description = "WOFF file carrying an appended @@ENDFONT@@ marker and Base64 payload, as used to stage FLATROOF" author = "[RL researcher], ReversingLabs" date = "2026-10-31" reference = "https://www.reversinglabs.com/blog/[post-slug]" hash = "62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38" score = 85 strings: // Delimiter between decoy font data and the encrypted payload $marker = "@@ENDFONT@@" ascii // Base64 run that follows the marker (long, no whitespace) $b64 = /@@ENDFONT@@[A-Za-z0-9+\/]{512}/ ascii condition: uint32be(0) == 0x774F4646 // "wOFF" and filesize < 20MB and $marker and $b64 } rule RL_TraderTraitor_FlatroofLoader_Script_2026 { meta: description = "Shell loader that splits a .woff file at the @@ENDFONT@@ marker to recover the FLATROOF payload" author = "[RL researcher], ReversingLabs" date = "2026-10-31" reference = "https://www.reversinglabs.com/blog/[post-slug]" hash = "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97" score = 75 strings: $marker = "@@ENDFONT@@" ascii $woff = ".woff" ascii condition: uint32be(0) != 0x774F4646 and filesize < 200KB and $marker and $woff } We chose the marker and the Base64 run that follows it because the loader's decryption logic depends on both: a variant that changes them must also change the loader. The font names are spoofable, so we did not use them. False positives should be rare, but test the rules against a corpus of web fonts and build scripts before production use. For a tighter variant, require the marker immediately followed by the OpenSSL salt header, $hdr = "@@ENDFONT@@U2FsdGVkX1" ascii, in place of $marker; in the RL-held sample the Base64 begins right after the marker. That is a precision improvement only, and it will miss a variant that inserts whitespace or changes cipher mode. We ran both rules as an RL Cloud Retro hunt on October 31, 2026. The run ended before covering the full corpus (it was cancelled after more than 70% progress), so treat the results as partial. It produced four unique matches. Both positive controls matched. The font rule also matched two WOFF files that appear in no published IOC list: SHA-256 | SHA-1 | MD5 | RL status (TCA-0101) | |---|---|---|---| 76ec916464baf025c9573f78fc413f5eab0d03f4ada6cd247671f0f4ab4fbcae | 959ad1ba59212c69526eae10e12d8dc58ecaf2dd | 8d4caaa508cdb6f04fa670a339026f6c | known, 0 of 38 scanners, first seen 2026-10-09 | 1f96fc738fecc8e137244b5c3d0890ba2e618c57975478716bf20848eecda1e0 | 05683f6207251be0c085de35fcb7c5d2ac1d0b68 | 2d0ab2e7342f8face5b1558fddea1712 | known, 0 of 38 scanners, first seen 2026-10-09 | Both were first seen on October 9, the day after the Zscaler publication, and no scanner flags either one. We assess it is likely these are additional FLATROOF containers absent from any published IOC list, with a goodware classification that reflects the payload being encrypted at rest. We could not confirm that: Spectra Intelligence marks both as not available for download, because they came in as private uploads, so RL could not retrieve or decrypt them. They stay hunting leads, not confirmed IOCs. Figure 6. Matches for the RL_TraderTraitor_Flatroof_v1 ruleset in Spectra Analyze. The cloud rows show the two positive controls (suspicious) and the two unpublished WOFF files (goodware). The bottom two rows are local re-matches of the positive controls after RL pulled them onto the appliance. title: Terraform Provider Plugin Spawning Shell or Network Utility id: 4f2a9c61-8b3e-4d7a-9e15-2c6d0b7f3a18 status: experimental description: Detects a Terraform provider plugin process launching a shell, curl or decryption tooling, as seen with the trojanized terraform-provider-awsbeta used to deliver FLATROOF references: - https://www.reversinglabs.com/blog/[post-slug] author: [RL researcher], ReversingLabs date: 2026-10-31 tags: - attack.execution - attack.t1059.004 - attack.initial_access - attack.t1195.001 logsource: product: macos category: process_creation detection: selection_parent: ParentImage|contains: '/terraform-provider-' selection_child: Image|endswith: - '/sh' - '/bash' - '/zsh' - '/curl' - '/openssl' - '/xattr' - '/codesign' condition: selection_parent and selection_child falsepositives: - Community providers that legitimately shell out (rare; review and allow-list by provider name and signer) level: high Duplicate the rule with product: linux for Linux build hosts. On Windows, alert on a terraform-provider-*.exe parent spawning powershell.exe, cmd.exe or curl.exe. Security teams using Spectra Intelligence can query the hashes and domains in the IOC section and see RL's current classification, threat name and first-seen date for each, including the earlier ROOFDECK builds identified here. Spectra Analyze's YARA hunting module can run the FLATROOF container rule against local repositories and RL's cloud corpus, and RHA similarity search, which surfaced the ROOFDECK siblings, can be re-run as new samples appear. Spectra Detect customers can deploy the YARA rule at ingestion to flag font files carrying staged payloads in build artifacts and package caches. Figure 4. Spectra Analyze RHA similarity results for macOS ROOFDECK. Note the three 4.7 MB malicious Mach-O files: the published sample (MacOS.Backdoor.GetShell) and two earlier siblings (MacOS.Exploit.ReverseShell) first seen four and five months ago. Figure 5. Spectra Core ATT&CK mapping for the trojanized Terraform provider. Note Sudo and Sudo Caching (T1548.003), Setuid and Setgid (T1548.001) and File Deletion (T1070.004) alongside the discovery techniques. The Binance theft illustrates how attackers can exploit trust in developer environments to compromise critical infrastructure. What began with malicious software and social engineering progressed into the compromise of multiple engineering systems and ultimately unauthorized access to wallet-signing operations. The FBI's attribution and Binance's newly disclosed attack sequence provide important clarity. ReversingLabs' contribution is a deeper look into the surrounding malware ecosystem: malicious software observed months before public disclosure, backdoors with earlier histories, and threats that conventional security classifications may fail to connect. For defenders, the lesson extends beyond cryptocurrency exchanges. Detecting malicious functionality inside trusted software, understanding its behavior, and connecting related threats across time are critical to stopping attacks before they reach business-critical systems. The specific relationship between the malware analyzed here and the Binance incident remains unconfirmed. Nevertheless, the intelligence provides actionable hunting guidance for organizations looking to strengthen their defenses against developer-targeted attacks. As the malware ecosystem evolves, RL will continue to monitor, decode, and report on these changes, helping organizations spot threats before they escalate. Oct 30-31, 2026 | TraderTraitor "likely," not certain | Laundering alongside Bitget proceeds; shared services with TraderTraitor thefts of BigONE, WOO X and AFX; Bybit-like staff targeting and signing abuse. Cautions: small overlap, slower laundering than usual | Secondary reporting: TechCrunch, Euronews, Hackread, Cointegrity | Oct 30, 2026 | Report the TRM and Elliptic attributions; Cointegrity calls TraderTraitor "probable, not confirmed" | Independent review of the above; the shared Bitget/Binance address holds about $39,000 of Binance-linked funds | FLATROOF C2 4/48 | delay[.]servehttp[.]com | ROOFDECK C2 | 3/49 | hxxps://pastebin[.]com/raw/3yptBDhL | ROOFDECK dead drop | 0/49 | be60c52ca8a01fef7dc15c2f0ebb77d8 HiraginoSans-Regular.woff, encrypted FLATROOF (macOS ARM64), RL: MacOS.Trojan.Flatroof | 3c254614de8c1a2f213c526b0e5072d43ffeb7cc340d9a4a6ebaa16592b3bbe0 | 13888e384b2747758aca2e42dee7dc63393b9f57 | dfa191ca6817ec56e6986e728b323f92 | Decrypted FLATROOF (macOS ARM64), Rust Mach-O installed as SystemUpdate; recovered by RL from the container above, RL first seen 2026-07-23, RL: MacOS.Trojan.Gaslight | 4ba58fba8e1293e1d980726323bda0fcd3cc1e5781a99e86638a4a7641b6ffd6 | 93c655963d7dd6cac017d9a59f54f7cee196fc89 | 2b81aceab0142472d94eb42e500b27b1 | imagent, macOS ROOFDECK, RL: MacOS.Backdoor.GetShell | e1c71374814e5d907afb913108090b8abf21ae2131c0880f013a3b9108a9d0fc | 0b7ca6630ea1e66b7d96f3adf2a3e25b08fc1e92 | 9d88b4494c7bc27b10358b68a899ad54 | update.exe, Windows ROOFDECK, RL first seen 2025-09-09, RL: Win64.Trojan.ReverseShell | 61a110681a70af3dc21634558e12b1c00964f0cf48e90c89896eb0fda1e60b2d | 20e541a41fc8b0e201c7d26a66bbfd1d078f61b3 | c22a69c45ec74af11a9f87f195ebd392 | macOS RHA sibling of ROOFDECK, RL first seen 2026-05-22, RL: MacOS.Exploit.ReverseShell (new, RL) | f3404ef308098202246f2f3c38c8c3166e9a8e7843ec69c1b11ac0ce9cb4038e | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | c43f594fac7544e5485cbbe441e470bf | macOS RHA sibling of ROOFDECK, RL first seen 2026-07-13, RL: MacOS.Exploit.ReverseShell (new, RL) | supportaru[.]serveftp[.]com Domain | FLATROOF payload host | hxxps://supportaru[.]serveftp[.]com/statics/cache/v11/ | URL | FLATROOF payload base URL, primary in the loader (written there with a doubled https://https:// scheme) | hxxps://raw[.]githubusercontent[.]com/bluearuhost/hospitalrun-frontend/refs/heads/main/public/fonts/version1/ | URL | FLATROOF payload base URL, backup 1 (GitHub) | stage-fashion365[.]vercel[.]app | Domain | FLATROOF payload mirror | hxxps://stage-fashion365[.]vercel[.]app/static/tinymce4.7.5/plugins/fonts/v1104 | URL | FLATROOF payload base URL, backup 2 (Vercel) | arusupport-region1-webhook[.]online | Domain | FLATROOF C2 webhook; RL URL records first saw it 2026-07-25 | hxxps://arusupport-region1-webhook[.]online/statics/cache/v11/abicfjej | URL | Full URL on the FLATROOF C2 host, as published by Zscaler | delay[.]servehttp[.]com | Domain | ROOFDECK C2 | hxxps://pastebin[.]com/raw/3yptBDhL | URL | ROOFDECK signed C2 dead drop | 176[.]97[.]114[.]232 | IP | AS6698; served MacOS.Backdoor.GetShell per RL | 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 ETH address | Received both Binance and Bitget-exploit funds | bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s | BTC address | First of 19 BTC lots (18,270 BTC); full list in repository | Command and Scripting Interpreter: Unix Shell / Python | T1059.004, T1059.006 | safari_updater; ROOFDECK shell; FLATROOF credential stealers | RL, 3P | Native API | T1106 | Provider and ROOFDECK | RL | Event Triggered Execution: Unix Shell Configuration Modification | T1546.004 | ~/.zlogout persistence on macOS | 3P | Abuse Elevation Control Mechanism: Setuid and Setgid / Sudo | T1548.001, T1548.003 | Provider and ROOFDECK | RL | Masquerading: Match Legitimate Name / Masquerade File Type; process argument | T1036, T1036.005, T1036.008 | SystemUpdate, imagent; payload as .woff; payload launched with --type=renderer to resemble a Chromium renderer | 3P; RL (--type=renderer, loader analysis) | Obfuscated Files or Information: Embedded Payloads / Encrypted File | T1027.009, T1027.013 | AES-encrypted executable after @@ENDFONT@@ | RL (T1027), 3P | Deobfuscate/Decode Files or Information | T1140 | Loader splits the container at @@ENDFONT@@, Base64-decodes and AES-256-CBC decrypts it with a hardcoded passphrase | RL (loader analysis) | Subvert Trust Controls: Gatekeeper Bypass / Code Signing | T1553.001, T1553.002 | Quarantine attribute removal and ad hoc signing | 3P | Indicator Removal: File Deletion | T1070.004 | Loader and backdoor cleanup; self-destructing tooling in the theft | RL; 3P (Elliptic) | OS Credential Dumping: /etc/passwd and /etc/shadow | T1003.008 | ROOFDECK and RHA siblings | RL | Credentials from Password Stores: Keychain / Windows Credential Manager | T1555.001, T1555.004 | FLATROOF stealers | 3P | Steal Web Session Cookie | T1539 | Browser cookie theft for session reuse | 3P | Unsecured Credentials: Shell History | T1552.003 | Shell history collection | 3P | System Information / File and Directory / Account / Network Configuration Discovery | T1082, T1083, T1087.001, T1016 | All RL samples | RL | Security Software Discovery | T1518.001 | Checks for Cortex XDR / Traps | 3P | Web Service: Dead Drop Resolver / Fallback Channels | T1102.001, T1008 | Nostr profile -> Pastebin -> C2; Telegram, GitHub, webhook | 3P | Valid Accounts | T1078 | Engineer access to service container | Inferred for Binance | Data Manipulation: Transmitted Data Manipulation | T1565.002 | Signing service made to sign attacker transactions | Inferred for Binance | Financial Theft | T1657 | Theft of about $6.3 billion | Binance, TRM, Elliptic | This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them. First reported by ReversingLabs in February, the malware has moved to Terraform providers and Go modules. Here’s what you need to know.