#ParsedReport #CompletenessHigh
08-10-2026

Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver

Report completeness: High

Actors/Campaigns:
Tradertraitor (motivation: information_theft)
Pressure_chollima

Threats:
Gaslight_backdoor
Roofdeck
Dead_drop_technique
Process_injection_technique
Process_hollowing_technique

Victims:
Cryptocurrency industry, Web3 developers, Cloud engineers, Developers

Industry:
Government

Geo:
North korea

TTPs:
Tactics: 3
Technics: 26

IOCs:
File: 10
Domain: 2
Url: 6
Hash: 12

Soft:
macOS, Linux, Pastebin, Node.js, OpenSSL, Telegram, Firefox, Chrome, Chromium, Unix, have more...

Wallets:
metamask, rabby

Algorithms:
aes-256-gcm, aes-256-cbc, base64, zip, aes, xor

Languages:
powershell, python, rust, perl

Platforms:
amd64, x86, cross-platform, apple, arm, intel