TraderTraitorThreat actor
- Jade Sleet
- pukchong
- UNC4899
TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.From MISP Galaxy
Last reported 9 days ago, by AhnLab ASEC15 reports
ATT&CK techniques
6 of 32 · each with the sentence it comes from- T1684Social Engineering
“Their research provides detailed insight into the social engineering and initial intrusion aspects of the campaign.”
- T1552.004Private Keys
“GoBalance bug exposes onion private keys: A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services.”
- T1036Masquerading
“CL-STA-1178: An Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1195Supply Chain Compromise
“Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise”
- T1657Financial Theft
“Salaries were remitted to North Korea to help circumvent sanctions, while access obtained through employment could also support financial theft or espionage.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on APT Groups“…APTTrend202609 Callisto FamousChollima FamousSparrow Fireant JadeSleet Kimsuky KONNI MirageKitten NightEagle StarBlizzard Storm-3069 TraderTraitor TransparentTribe UAC-0099 UAT-11587 UTA0565”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“TraderTraitor abuses Terraform: Zscaler has attributed recent incidents involving malicious Terraform image providers to North Korean APT group TraderTraitor.”
-
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware“Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware”
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 117“Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties”
-
Security Affairs newsletter Round 598 by Pierluigi Paganini – INTERNATIONAL EDITION“Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties”
-
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M“Those overlaps pointed to the North Korean group TraderTraitor, but TRM had not made a firm attribution.”
-
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise“The development comes about a week after SentinelOne attributed the North Korea-linked TraderTraitor group to an attack targeting an India-based information technology (IT) services company.”
-
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry“In a report published last week, SentinelOne detailed how the threat activity cluster codenamed TraderTraitor relied on weaponized Terraform lock files to facilitate the delivery of Rust-based backdoors from custom Terraform provider registries under their control.”
-
Risky Bulletin: Gemini hacked three companies too“New TraderTraitor tools: SentinelOne has published a more in-depth analysis of the TraderTraitor attack on LayerZero's KelpDAO platform earlier this year.”
-
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties“Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties”
-
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters“The research, published on September 7, categorized the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.”
-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“… made our clustering evolved by splitting the Lazarus umbrella into six distinct sub-clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima.”
-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“In the most significant case, North Korean threat actor UNC4899 reportedly used social engineering to compromise a developer's machine at a web3 organization.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“First seen in 2022, TraderTraitor is a malicious application derived from various open-source projects.”
-
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist“Behind this incredible theft is believed to be North Korea’s elite cyber-offensive unit, referred to as TraderTraitor.”
Indicators in its reports
named in the reports above- hashicorp-terraform[.]ioin 2 reports
- itorrents[.]orgin 1 report
- gocommunity[.]ioin 1 report
- gogets[.]devin 1 report
- 193.247.144[.]38in 1 report
- registry.hashicorp-aws[.]comin 1 report
- registry.hashicorp-aws[.]ioin 1 report
- registry.hashicorp-terraform[.]ioin 1 report
- 176.97.114[.]232in 1 report
- 45.11.59[.]140in 1 report
- 85.137.56[.]10in 1 report
- grenight[.]comin 1 report
- 85.137.56[.]245in 1 report
- api.nostr[.]watchin 1 report
- nostr[.]momin 1 report
- relay.snort[.]socialin 1 report
- offchain[.]pubin 1 report
- nostr.oxtr[.]devin 1 report
- nostr[.]winein 1 report
- 1cd6d13ff15adbf7a42025d10ec99b4ain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.