Weekly CTI roundup: Ryuk access broker sentenced, TraderTraitor FLATROOF/ROOFDECK macOS backdoors, AI-agent skimming of 600K cards
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS identified a second TraderTraitor (Lazarus subgroup) victim, an Indian IT services firm, infected with the macOS Rust backdoors FLATROOF and ROOFDECK, which shows DPRK targeting expanding beyond crypto firms to developer endpoints and software supply chains. A lone, financially motivated actor used the open-source AI frameworks Strix, Cairn and Hermes to compromise more than 100 e-commerce sites and exfiltrate over 600,000 credit card records, at an estimated cost of about $25 per target.
Technical Details
- Ryuk: Vardanyan acted as initial access specialist between March 2019 and June 2020. The group extorted about 1,610 BTC (over $15 million). Victims included an Oregon technology company, a Texas school and a Michigan business that paid 200 BTC.
- TraderTraitor (UNC4899, PUKCHONG, Jade Sleet): After the April compromise of LayerZero Labs, a second victim was found in India. Operators pose as recruiters offering fake job interviews to DevOps and infrastructure engineers and share GitHub repositories containing weaponized Terraform lock files. The lock files point to custom provider registries on attacker-controlled, typosquatted HashiCorp domains. Running Terraform initialization downloads and executes the backdoor.
- FLATROOF/ROOFDECK: FLATROOF runs shell commands and exfiltrates browser data, command histories and keychains via Telegram bots. It suppresses Gatekeeper to launch ROOFDECK, which resolves its C2 through the decentralized Nostr protocol. The initial target was an Apple Silicon MacBook.
- AI-driven skimming (active since July 2026): Strix ran 633 hours of vulnerability scanning over nine days against 138 hosts. Cairn handled autonomous exploitation to gain admin access and shells. Hermes orchestrated the campaign with a red team persona and 78 attack skills. Skimmers were injected into legitimate JavaScript files, poisoned cloud storage buckets and altered Kubernetes deployments, with persistence via cron jobs. Hermes then wiped source database fields in batches, causing operational data loss. Targets included a Fortune 500 hospitality firm, a major US airline, an online fashion retailer and an industrial supplies distributor.
Remediation
- Secure developer and DevOps workstations against supply chain lures. These machines hold elevated cloud credentials and source control access.
- Treat unsolicited coding challenges and repositories from recruiters as untrusted, and review Terraform lock files and provider registry sources before initialization.
Linha do tempo
-
Weekly CTI roundup: Ryuk access broker sentenced, TraderTraitor FLATROOF/ROOFDECK macOS backdoors, AI-agent skimming of 600K cards
ler a análise desta fonte ocultar
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS identified a second TraderTraitor (Lazarus subgroup) victim, an Indian IT services firm, infected with the macOS Rust backdoors FLATROOF and ROOFDECK, which shows DPRK targeting expanding beyond crypto firms to developer endpoints and software supply chains. A lone, financially motivated actor used the open-source AI frameworks Strix, Cairn and Hermes to compromise more than 100 e-commerce sites and exfiltrate over 600,000 credit card records, at an estimated cost of about $25 per target.
Technical Details
- Ryuk: Vardanyan acted as initial access specialist between March 2019 and June 2020. The group extorted about 1,610 BTC (over $15 million). Victims included an Oregon technology company, a Texas school and a Michigan business that paid 200 BTC.
- TraderTraitor (UNC4899, PUKCHONG, Jade Sleet): After the April compromise of LayerZero Labs, a second victim was found in India. Operators pose as recruiters offering fake job interviews to DevOps and infrastructure engineers and share GitHub repositories containing weaponized Terraform lock files. The lock files point to custom provider registries on attacker-controlled, typosquatted HashiCorp domains. Running Terraform initialization downloads and executes the backdoor.
- FLATROOF/ROOFDECK: FLATROOF runs shell commands and exfiltrates browser data, command histories and keychains via Telegram bots. It suppresses Gatekeeper to launch ROOFDECK, which resolves its C2 through the decentralized Nostr protocol. The initial target was an Apple Silicon MacBook.
- AI-driven skimming (active since July 2026): Strix ran 633 hours of vulnerability scanning over nine days against 138 hosts. Cairn handled autonomous exploitation to gain admin access and shells. Hermes orchestrated the campaign with a red team persona and 78 attack skills. Skimmers were injected into legitimate JavaScript files, poisoned cloud storage buckets and altered Kubernetes deployments, with persistence via cron jobs. Hermes then wiped source database fields in batches, causing operational data loss. Targets included a Fortune 500 hospitality firm, a major US airline, an online fashion retailer and an industrial supplies distributor.
Remediation
- Secure developer and DevOps workstations against supply chain lures. These machines hold elevated cloud credentials and source control access.
- Treat unsolicited coding challenges and repositories from recruiters as untrusted, and review Terraform lock files and provider registry sources before initialization.