Trojanized Terraform Provider Campaign

This technical analysis describes a supply-chain style campaign where a trojanized Terraform provider executes a cross-platform Bash loader that downloads encrypted payloads disguised as font files, installing FLATROOF (a cross-platform backdoor with Python-based infostealers targeting browser and system artifacts) and ROOFDECK (a backdoor with resilient C2 discovery via signed Pastebin and Nostr). The report details infection chains, payload storage paths, persistence mechanisms, C2 channels (Telegram, GitHub, webhooks), configuration examples, and indicators such as domains, filenames, and decryption keys.