Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

Date (as written): 2026-09-18T17:00:16.000Z
Year: 2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

India-based IT services provider, compromised via a DevOps engineer's Apple Silicon MacBook · 21/09/2026

Researchers detail a Jade Sleet campaign that compromised an India-based IT services provider through a fake job-interview lure on GitHub targeting a DevOps engineer; a weaponized Terraform dependency lock file pointed to attacker-controlled modules that, when "terraform init" was run, deployed two Rust-based macOS backdoors, FLATROOF (Telegram-based C2) and ROOFDECK (Nostr protocol-based C2), with implants detected as early as March 18, 2026 and beaconing from March 29, 2026, plus an updated ROOFDECK variant deployed in April 2026. [Date Occurred: Since 18/03/2026; Date Discovered: Unspecified]

https://www.hackmageddon.com/2026/09/29/september-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/1sn0d9OIEXxw2D2hmWK69emA2dTuDXr0FeJba33JQUc4/export?format=csv&gid=0

https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html

SentinelOne SentinelLabs

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne · 2026-09-18T17:00:16.000Z

North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.

https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/

Suggest a correction on GitHub