{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14675","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-03-18T00:00:00Z","dateUpdated":"2026-11-06T04:06:02Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"TraderTraitor (DPRK) fake job-interview Terraform coding challenge; README instructs use of the malicious registry.hashicorp-aws.io provider. Running terraform init installs the FLATROOF and ROOFDECK macOS backdoors.\n\n=== Delivery: weaponized .terraform.lock.hcl ===\nFake provider registries: registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io\nBehavior: `terraform init` fetches and executes a trojanized provider that drops FLATROOF and ROOFDECK.\n\n=== FLATROOF (macOS.Gaslight) ===\nBinary: ~/Library/com.apple.iTunesCloud/SystemUpdate (SHA1 02df07a173ab03b82a4fb6a08973fff8b1467f28)\nLock file: $TMPDIR/tmp*.lock\nC2: technicais.sytes.net (176.97.114.232)\nBehavior: Rust backdoor; strips Gatekeeper quarantine from ROOFDECK, runs shell commands, harvests browser data, keychain files and shell histories over Telegram.\n\n=== ROOFDECK ===\nBinary: ~/Library/com.apple.internal.ck/iSync (SHA1 c491d477dbe0ae04e9aed9dbe237144c03f73ec4)\nStripped variant: ~/Library/com.apple.appleaccountd/loginwindow (SHA1 5728b11d30586bbfc1d8bd12df1c722a06e767a2)\nIPC pipe: /private/tmp/.pipe-airway; config: $HOME/.config/.repl_history\nPersistence: ~/Library/LaunchAgents/*.plist (Label com.*, ProgramArguments --type=renderer, RunAtLoad)\nC2: storage.hubpage.cloud (45.11.59.140), grenight.com (85.137.56.245); staging 85.137.56.10; HTTPS tasking endpoint /app_version\nCustom TLS cert (mkcert, CN=mkcert ub@ub-Standard-PC-Q35-ICH9-2009) SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa, SHA-1 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82, serial 1cd6d13ff15adbf7a42025d10ec99b4a\nBehavior: Rust backdoor; resolves C2 via an operator Nostr profile, signed+encrypted tasking, reverse shell, wallet/key search, clipboard read/replace.","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/7984bbce-1f49-4b71-888c-cf2d6df766a9","name":"Malicious repository: https://github.com/RyanLRay/Technical-Assessments","tags":["advisory"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"","collectionURL":"","packageName":"","repo":"https://github.com/RyanLRay/Technical-Assessments","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}