Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Zscaler ThreatLabz discovered a TraderTraitor-linked supply-chain campaign that trojanized a Terraform AWS provider to run a cross-platform Bash loader which retrieves encrypted payloads disguised as .woff font files; these deploy FLATROOF (Rust backdoor with OS-specific Python stealers targeting browser credentials, wallets, and system artifacts) and ROOFDECK (backdoor with layered C2 discovery using signed Pastebin and Nostr metadata) to exfiltrate data and maintain persistent access, and the report includes technical analysis, IOCs, MITRE mappings, and recommended mitigations.