Executive Summary

Last week’s reporting returned to a familiar target: developers with access to cloud, source-code, and cryptocurrency environments. Zscaler analyzed a trojanized Terraform provider that delivered FLATROOF and ROOFDECK across macOS, Linux, and Windows. Unit 42 connected this approach to a wider set of poisoned dependencies and blockchain-based command channels, while OpenSourceMalware reconstructed how PolinRider hid the real timing of a GitHub repository compromise.

Kimsuky also expanded Operation GitPower against Ukrainian foreign-policy and security experts through reply-bait spearphishing, malicious shortcuts, and a fake Zoom installer. Separate investigations exposed a Chinese network laundering proceeds from DPRK-linked cryptocurrency thefts and the routines inside North Korean IT-worker compounds. Security Alliance recorded three more DPRK cases, including an $86,700 key compromise and two fake-meeting intrusions.

Key Trends

1. Terraform and repository trust became execution paths

Zscaler uncovered a July campaign in which a trojanized Terraform provider retained a functional provider scaffold while launching a cross-platform Bash loader. The chain delivered FLATROOF, which established persistent command execution and installed Python stealers, followed by ROOFDECK for remote access. The stealers collected browser credentials, cookies, shell history, system data, and cryptocurrency-wallet extension artifacts. ROOFDECK used Pastebin and Nostr to recover command infrastructure.¹

Zscaler linked the activity to TraderTraitor and found substantial overlap with the Kelp DAO incident. The delivery method remained unknown, but the provider’s placement would put developer workstations and CI systems at risk when Terraform loaded it. The case adds infrastructure-as-code plugins to the files that require provenance checks before execution.¹

Unit 42 placed the technique within a larger series of cloud supply-chain attacks. Its analysis connected Alluring Pisces activity across compromises involving Axios, Mastra AI, and Rust’s arrayref crate through beacon behavior, TLS configurations, and hosting ranges. It also described PolinRider loaders that recovered replaceable command servers from transaction data on public blockchains, letting operators rotate endpoints without changing code already present in repositories.²

Repository history can conceal when that code arrived. OpenSourceMalware found that an attacker controlling a developer account replaced a legitimate signed commit in nestjsx/nest-access-control, backdated the forged commit to December 2025, and pushed the poisoned tree across at least 16 branches in 38 seconds. A hidden VS Code folder-open task ran JavaScript disguised as a font file. GitHub server events and npm publication records established the real September 2026 timeline, and the published npm package remained clean because it referenced the commit from before the tampering.³

2. Operation GitPower moved Kimsuky deeper into Ukraine-focused collection

Genians attributed Operation GitPower to Kimsuky and documented targeting of Ukrainian foreign-policy, security, and civil-society experts. Operators impersonated conference organizers and policy researchers, first sending benign messages that asked recipients to reply. Follow-up archives carried PDF-disguised LNK files, while another sequence used a fake Zoom installer.⁴⁵

The shortcuts downloaded VBE and PowerShell stages from GitLab. Scheduled tasks maintained persistence, and later code collected system information and file listings before sending results through the GitHub Contents API. Other variants used a dedicated TCP command server. Genians based its attribution on overlap in first.ini and help.ini code, API handling, filenames, obfuscation markers, persistence, and infrastructure. The operators reused GitHub, GitLab, and Codeberg across lures adapted for Ukrainian, Japanese, and Korean targets.⁴⁵

3. Laundering partners bridged DPRK thefts to Chinese criminal markets

ZachXBT reported infiltrating a Chinese laundering network after the $1.5 billion Bybit theft attributed to TraderTraitor. By posing as a client and trading with an operator using the alias Jimmy Green, he obtained addresses and messages that exposed a cluster handling more than $12 million in Bybit proceeds across Bitcoin, Ethereum, Solana, and Tron. The investigation contributed to Tether freezing 442,000 USDT.⁶

The operator claimed his team had laundered most of the Bybit proceeds and discussed DPRK-related transfers before some movements occurred. ZachXBT also connected the network to funds from the Bitget, Kelp DAO, and Poloniex exploits. The findings describe a service layer that can exchange assets, cross chains, and place stolen funds into mixing or cash-out routes without the intrusion operators managing every step themselves.⁶

4. IT-worker evidence shifted from personas to compound routines

Hayden McKenzie analyzed roughly two million Slack messages from 1,236 accounts used by North Korean IT workers assessed to be based in Rason. The messages documented U.S. working hours, screen monitoring, shared living and transport, use of Astrill and remote-access infrastructure, and monthly earnings quotas tied to discipline and recreation. Discussions of North Korean places, holidays, language, food, currency, travel, and party obligations supported the report’s assessment of the workers’ origin and location.⁷

The archive gives employers a different set of signals from the fabricated resumes and interview stand-ins documented in earlier reporting. Overnight work patterns, reused network infrastructure, remote desktop access, device characteristics, and communications behavior become more useful when evaluated together across hiring, endpoint, identity, and payment records.

A separate North Korean trade directory assembled ten years of company, product, contact, and location data from Foreign Trade of the DPRK. Shared telephone numbers and email addresses connected 42% of listed companies into 57 clusters. Cross-checking those records against UN sanctions data found links to several designated organizations, although the researchers marked some matches as uncertain. The directory offers investigators additional pivots when company identities or contact details appear in worker, payment, procurement, or infrastructure inquiries.⁸

5. Fake meetings continued to produce both access and losses

Security Alliance handled three DPRK cases during its reporting period. Two involved UNC1069 fake-meeting intrusions with no reported losses. A third involved a compromised key and an $86,700 loss. Investigators also published seven new high-confidence domains associated with UNC1069 infrastructure.⁹

The cases keep meeting invitations in the same defensive frame as poisoned repositories and coding tests. A calendar conversation, conferencing download, or technical assignment can all lead to credential theft on systems that hold source-code, cloud, or wallet access.

What to Watch

Development teams should verify Terraform providers, editor tasks, repository pushes, and package releases against records that attackers cannot rewrite locally. Compare commit author dates with server-side push events, registry publication times, audit logs, and surviving commit objects. Alert when developer tools contact public blockchain APIs before connecting to new raw IP addresses, Pastebin, Nostr relays, or unexpected code-hosting endpoints.

Organizations handling Ukraine-related policy work should treat replies to unsolicited conference or research invitations as the start of the attack chain, even when the first message has no link or attachment. Cryptocurrency investigators should retain cross-chain and counterparty evidence long enough to map laundering brokers, not only the wallets directly controlled by the initial thief.

Reports Reviewed