North Korea's Lazarus Group Tied to Second macOS Backdoor Attack

A financially motivated subgroup of North Korea's Lazarus group, known as TraderTraitor, has been linked to a second macOS backdoor attack. The attackers used fake job interview lures and weaponized GitHub repositories to gain access to a DevOps engineer's machine. The machine held cloud credentials and source control access.

The backdoors, named FLATROOF, tracked as macOS.Gaslight, and ROOFDECK, are ARM64 macOS implants written in Rust. They were first observed in the April LayerZero breach, which stole USD 292 million from KelpDAO, a DeFi protocol supporting Ethereum restaking.

The campaign uses fake job interview lures in the style of the Contagious Interview approach, aimed at people working in DevOps or crypto and FinTech engineering. The repositories carry a weaponized .terraform.lock.hcl file whose malicious custom provider points to an attacker-controlled domain.