The malicious mechanism relies on weaponized '.terraform.lock.hcl' files. By configuring these files to point to attacker-controlled domains - such as registry.hashicorp-aws[.]com - the threat actor forces the execution of terraform init to download and run arbitrary malicious provider modules. Once the victim executes the code on their macOS workstation, the FLATROOF (macOS.Gaslight) and ROOFDECK backdoors are deployed. These backdoors enable the attackers to establish persistence, collect sensitive cloud API keys (AWS, GCP), and perform lateral movement. The campaign targets individuals in the IT services sector regardless of cryptocurrency ties, demonstrating a broad operational scope for gaining unauthorized access to production cloud environments.

Attack Chain

1. Attacker establishes contact with a target developer via social engineering through fake job interview lures on GitHub.
2. Target downloads a weaponized coding project repository containing a modified '.terraform.lock.hcl' file.
3. Victim executes terraform init within the project directory on their macOS workstation.
4. Terraform client reaches out to an attacker-controlled registry domain (e.g., registry.hashicorp-terraform[.]io) to download the provider.
5. Malicious provider code is executed, deploying FLATROOF and ROOFDECK backdoors onto the local macOS system.
6. Backdoors perform a Gatekeeper bypass by executing xattr -rd com.apple.quarantine and changing file permissions (chmod +x).
7. Implants establish persistent C2 communication via hardcoded IPs and transmit stolen cloud credentials to the threat actor.
8. Attacker uses stolen credentials to escalate privileges and access cloud infrastructure (AWS/GCP).

Impact

Successful compromise results in full access to the victim's local developer workstation, theft of cloud environment credentials (AWS, GCP, OVH), and potential lateral movement into the organization's cloud production environments. This threat impacts DevOps teams and software engineers, potentially leading to widespread unauthorized access to private corporate infrastructure, data exfiltration, or further supply chain compromises.

Recommendation

• Audit all terraform init activity and restrict egress traffic for developer workstations to verified Terraform registry domains (registry.terraform.io) only.
• Block the malicious provider registry domains listed in the IOC table at the DNS resolver level.
• Deploy Sigma rules to detect unauthorized execution of terraform commands from non-standard directories or unusual network destinations.
• Monitor macOS endpoints for suspicious process executions involving zsh spawning shell commands that include xattr or chmod +x on binaries located in application or temporary directories.
• Implement security awareness training regarding the risks of running third-party infrastructure-as-code project repositories from untrusted sources.