#ParsedReport #CompletenessHigh
18-09-2026

Don’t Call Us, We’ll Call Your APIs \| TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/

Report completeness: High

Actors/Campaigns:
Tradertraitor (motivation: financially_motivated)
Lazarus (motivation: financially_motivated)
Contagious_interview

Threats:
Gaslight_backdoor
Roofdeck
Typosquatting_technique
Dead_drop_technique
Launchagents_tool
Lightlesscan
Supply_chain_technique

Victims:
It services, Cryptocurrency trading

Industry:
E-commerce

Geo:
Dprk, North korea, India

TTPs:
Tactics: 3
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1036, T1036.005, T1057, T1070.004, T1071.001, T1082, T1102.001, T1105, T1119, have more...

IOCs:
IP: 4
Domain: 26
Url: 1
Hash: 3

Soft:
macOS, Telegram, Gatekeeper, Chrome, Firefox, Linux

Crypto:
ethereum

Algorithms:
aes, sha256, sha1, zip

Win API:
lockfile

Languages:
python, rust

Platforms:
apple, arm

Links:
https://github.com/derrix060/novacart\_interview/blob/main/providers.tf