Back to Intelligence

TraderTraitor FLATROOF/ROOFDECK, QuartzLine PDF Backdoor & SkyKick M365 Credential Abuse: OTX Pulse Detection Pack — 2026-10-19

SA
Security Arsenal Team
October 19, 2026
10 min read

Four concurrent OTX pulses paint a coherent picture of the current credential-theft and access-broker ecosystem: adversaries are no longer just stealing passwords — they are industrializing trusted-identity abuse across endpoints, mobile devices, and cloud SaaS control planes.

  1. TraderTraitor (DPRK / Lazarus subgroup) continues its FLATROOF, ROOFDECK, and macOS.Gaslight backdoor operations. Following the $292M KelpDAO theft via the LayerZero compromise, SentinelOne identified a secondary victim — an Indian IT services provider with zero cryptocurrency exposure. The intrusion path ran through a DevOps engineer, weaponized Terraform workflows, and abused legitimate cloud APIs for C2. This confirms TraderTraitor's pivot from pure crypto theft to supply-chain positioning: compromise the service providers whose credentials and pipelines unlock downstream targets.

  2. QuartzLine (Mandiant: CLOUDHAZE) is a fully functional Windows PDF viewer (observed as paperline.exe, fielddesk.exe) signed with a now-revoked EV code-signing certificate and distributed via malvertising. Behind the working UI sits a backdoor with command execution, Chrome credential/cookie theft, and staged payload delivery (Caira, IronBark). The EV certificate abuse and malvertising delivery chain mirror the playbook used by modern infostealer-as-a-service operations monetized through dark web credential markets.

  3. YuanKong RAT is a multi-tenant Android RAT whose operators leave account IDs, handles, and enrollment codes hardcoded in every build — a rare OPSEC failure enabling operator attribution. It uses overlay attacks and ADB privilege escalation, a two-key XOR payload unpacker, and a shared signing certificate across all tenants, indicating a malware-as-a-service model.

  4. ConnectWise Cloud Backup (SkyKick) credential compromise: a stolen M365 API credential was used from 144.172.64.128 on October 15 to mint Microsoft Graph tokens across hundreds of tenants, enumerated in sorted GUID order — unmistakably automated tenant harvesting. This is third-party OAuth/service-principal abuse at MSP scale, the exact pattern that precedes bulk mailbox exfiltration and downstream BEC.

Common thread: every pulse involves abuse of a trusted identity or trusted artifact — a signed binary, a vendor service principal, a shared malware certificate, or a developer's pipeline credentials. Credential theft is the payload; trusted access is the delivery mechanism.

Threat Actor / Malware Profile

TraderTraitor (Lazarus subgroup, DPRK)

  • Distribution: Social engineering of DevOps/engineering staff (fake recruiter and job-interview lures), trojanized tooling, and weaponized Terraform modules that execute attacker code during terraform plan/apply.
  • Payload behavior: FLATROOF and ROOFDECK provide persistent backdoor access; macOS.Gaslight targets macOS developer workstations with stealer and keychain-access capability.
  • C2: Abuse of legitimate cloud APIs and dynamic-DNS infrastructure (e.g., technicais.sytes.net, storage.hubpage.cloud) to blend C2 into sanctioned SaaS traffic — hence the reporting title "Don't Call Us, We'll Call Your APIs."
  • Persistence: Developer machine implant persistence plus persistence inside CI/CD and cloud automation, giving survivability beyond endpoint reimaging.
  • Anti-analysis: Living-off-the-cloud techniques, API-native C2, signed/legitimate tooling abuse.

QuartzLine / CLOUDHAZE

  • Distribution: Malvertising directing victims to download a trojanized PDF viewer (paperline.exe, fielddesk.exe).
  • Payload behavior: Working PDF renderer to defeat user suspicion; embedded backdoor executes remote commands and stages Caira and IronBark payloads; Chrome browser credential and cookie theft.
  • C2: DGA-flavored domain set including motherotters.com, healskills.com, beatramiro.com, flawlessgradecheered.com, tabbyottercub.com.
  • Persistence/Trust abuse: EV code-signing certificate (since revoked) to bypass SmartScreen and signature-based policy.

YuanKong RAT (Android)

  • Distribution: Multi-tenant MaaS builds; infrastructure on ktxapp.com, ktx123.net, and 206.82.1.14.
  • Payload behavior: Overlay attacks for credential phishing over legitimate apps, ADB-based privilege escalation, remote control.
  • Weaknesses (useful to defenders): Cleartext config files with decryption keys, two-key XOR unpacking, shared signing certificate across all builds, and hardcoded operator account IDs/handles — enabling cross-build clustering and operator attribution.

SkyKick/ConnectWise Credential Abuse

  • Vector: Compromised vendor OAuth/API credential for ConnectWise Cloud Backup; actor authenticated from 144.172.64.128 (associated range also includes .60 and .99) and pulled Microsoft Graph tokens across hundreds of M365 tenants in GUID-sorted order — scripted, automated harvesting.
  • Implication: Any tenant with the SkyKick/ConnectWise Cloud Backup service principal consented is potentially exposed. CVE-2025-11371 is flagged in the pulse and should be triaged against your exposure.

IOC Analysis

The pulse set contains four operational indicator classes:

  • IPv4 (network block/watchlist): 144.172.64.128, 144.172.64.60, 144.172.64.99 (SkyKick abuse source range — alert on any Graph/Azure AD sign-in from these), 206.82.1.14 (YuanKong C2).
  • Domains/hostnames (DNS sinkhole + proxy block): ktx123.net, www.ktxapp.com, technicais.sytes.net, storage.hubpage.cloud, and the QuartzLine set (motherotters.com, healskills.com, beatramiro.com, flawlessgradecheered.com, tabbyottercub.com). Note sytes.net is dynamic DNS — block the FQDN, not the parent zone.
  • File hashes (EDR blocklist + retro-hunt): SHA256/SHA1/MD5 for QuartzLine and TraderTraitor payloads (e.g., 77b4fd46...6e77ca, 7f1db334...3d73c3) and three YuanKong APK SHA256s. Several indicators carry de-duplicated hash-of-hash annotations (SHA256 of 3b00f51e...) — normalize these to the underlying sample hash before feeding blocklists.
  • CVE: CVE-2025-11371 — correlate with asset inventory for the affected product.

Operationalization: Push IPs/domains to firewall, DNS RPZ, and SWG; hashes to EDR custom blocklists and a 90-day retro-hunt. Ingest the full OTX pulses via the OTX DirectConnect API or TAXII into your TIP (OpenCTI, MISP), and let the TIP fan indicators out to Sentinel/Defender via threat intelligence connectors. Set the SkyKick IPs as high-confidence identity alerts in Entra ID / Sentinel rather than simple network blocks, since the actor authenticates to Microsoft cloud services directly.

Detection Engineering

YAML
---
title: QuartzLine / CLOUDHAZE Trojanized PDF Viewer Execution
id: 9f2a1c4e-7b3d-4e5a-a1c2-qzline000001
status: experimental
description: Detects execution of known QuartzLine trojanized PDF viewer binaries or unsigned PDF viewers spawning command interpreters, consistent with malvertising-delivered backdoor activity.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
selection_name:
    Image|endswith:
        - '\paperline.exe'
        - '\fielddesk.exe'
selection_child:
    ParentImage|endswith:
        - '\paperline.exe'
        - '\fielddesk.exe'
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\rundll32.exe'
        - '\mshta.exe'
condition: selection_name or selection_child
falsepositives:
    - Rare; legitimate PDF viewers do not spawn shells
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204.002
references:
    - https://expel.com/blog/quartzline-a-working-pdf-viewer-with-a-backdoor-inside/
date: 2026/10/19
modified: 2026/10/19
---
title: TraderTraitor Cloud API C2 and Dynamic DNS Beacons
id: 8e1b2d5f-6c4e-4f6b-b2d3-ttc2000002
status: experimental
description: Detects network connections to TraderTraitor FLATROOF/ROOFDECK C2 infrastructure including dynamic-DNS hostnames and cloud-storage themed domains.
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
selection_dns:
    DestinationHostname|contains:
        - 'technicais.sytes.net'
        - 'storage.hubpage.cloud'
selection_ip:
    DestinationIp:
        - '206.82.1.14'
condition: 1 of selection_*
falsepositives:
    - Unlikely; these FQDNs have no legitimate business use
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568.001
references:
    - https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
date: 2026/10/19
modified: 2026/10/19
---
title: Terraform Child Process Execution - Possible Weaponized Module
id: 7d0c3e6a-5d5f-4a7c-c3e4-tform0000003
status: experimental
description: Detects terraform.exe spawning shell or scripting interpreters, a pattern associated with TraderTraitor weaponized Terraform modules executing payloads during plan/apply.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
selection:
    ParentImage|endswith: '\terraform.exe'
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
        - '\cscript.exe'
        - '\curl.exe'
        - '\certutil.exe'
condition: selection
falsepositives:
    - Terraform local-exec provisioners in CI/CD; baseline expected pipeline hosts and alert off-baseline
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1195.002
references:
    - https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
date: 2026/10/19
modified: 2026/10/19
KQL — Microsoft Sentinel / Defender
// Hunt: SkyKick/ConnectWise credential abuse + TraderTraitor/QuartzLine C2
// Part 1: M365 sign-ins and Graph activity from the abuse source IPs
let BadIPs = dynamic(["144.172.64.128", "144.172.64.60", "144.172.64.99", "206.82.1.14"]);
let BadHosts = dynamic(["technicais.sytes.net", "storage.hubpage.cloud", "www.ktxapp.com", "www.ktx123.net", "motherotters.com", "healskills.com", "beatramiro.com", "flawlessgradecheered.com", "tabbyottercub.com"]);
union isfuzzy=true
    (SigninLogs
    | where IPAddress in (BadIPs)
    | project TimeGenerated, IPAddress, UserPrincipalName, AppDisplayName, ResourceDisplayName, ResultType, TokenIssuerType),
    (AADServicePrincipalSignInLogs
    | where IPAddress in (BadIPs)
    | project TimeGenerated, IPAddress, ServicePrincipalName, AppId, ResourceDisplayName, ResultType),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (BadIPs) or RemoteUrl in (BadHosts)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName in~ ("paperline.exe", "fielddesk.exe")
       or (InitiatingProcessFileName =~ "terraform.exe" and FileName in~ ("cmd.exe","powershell.exe","curl.exe","certutil.exe"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256)
| order by TimeGenerated desc
PowerShell
# Security Arsenal - IOC Hunt: QuartzLine, TraderTraitor, SkyKick abuse artifacts
# Run elevated on endpoints; outputs findings to console and CSV.
$results = @()

# 1) QuartzLine binaries and unsigned PDF viewers in user-writable paths
$paths = @("$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:LOCALAPPDATA","$env:APPDATA","C:\Users\Public","$env:TEMP")
$targets = @("paperline.exe","fielddesk.exe")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include $targets -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            $results += [pscustomobject]@{Check="QuartzLine Binary"; Path=$_.FullName; Detail="SigStatus=$($sig.Status); Signer=$($sig.SignerCertificate.Subject)"}
        }
    }
}

# 2) Known malicious file hashes (QuartzLine / TraderTraitor)
$badHashes = @(
  "7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3",
  "77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca"
)
Get-ChildItem -Path "$env:LOCALAPPDATA","$env:TEMP","C:\Users\Public\Downloads" -Recurse -File -ErrorAction SilentlyContinue |
  ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($badHashes -contains $h.ToLower()) {
        $results += [pscustomobject]@{Check="Malicious Hash"; Path=$_.FullName; Detail="SHA256=$h"}
    }
  }

# 3) Active/recent connections to known-bad IPs and domains
$badIPs = @("144.172.64.128","144.172.64.60","144.172.64.99","206.82.1.14")
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $results += [pscustomobject]@{Check="Bad IP Connection"; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) State=$($_.State) PID=$($_.OwningProcess)"}
}
foreach ($d in @("technicais.sytes.net","storage.hubpage.cloud","ktx123.net","ktxapp.com","motherotters.com","healskills.com","beatramiro.com","flawlessgradecheered.com","tabbyottercub.com")) {
    $r = Resolve-DnsName -Name $d -ErrorAction SilentlyContinue
    if ($r) { $results += [pscustomobject]@{Check="Bad Domain Resolves"; Path=$d; Detail=($r.IPAddress -join ",")} }
}

# 4) Persistence: Run keys, scheduled tasks referencing PDF viewers or temp paths
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    Get-ItemProperty $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "paperline|fielddesk|AppData|Temp" -and $_.Name -notmatch "^PS" } | ForEach-Object {
            $results += [pscustomobject]@{Check="Run Key Persistence"; Path="$k\$($_.Name)"; Detail=$_.Value}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match "paperline|fielddesk|terraform" } | ForEach-Object {
    $results += [pscustomobject]@{Check="Suspicious Scheduled Task"; Path=$_.TaskPath + $_.TaskName; Detail=$_.Actions.Execute}
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path ".\ioc_hunt_results.csv" -NoTypeInformation
Write-Host "Hunt complete. $($results.Count) finding(s)." -ForegroundColor Cyan

Response Priorities

Immediate (0-4h)

  • Block all listed domains/hosts at DNS and proxy; sinkhole the QuartzLine and YuanKong domain sets; block 206.82.1.14 and the 144.172.64.0/24 observation IPs at the edge.
  • Identity control plane first: create Sentinel/Entra alert rules for any sign-in or service-principal activity from 144.172.64.128, .60, .99. Audit all tenants with a ConnectWise Cloud Backup / SkyKick enterprise application consented: review its Graph permissions, recent sign-ins, and any mailbox/OneDrive access since 2026-10-15. Disable or rotate the credential pending vendor guidance.
  • Push QuartzLine/TraderTraitor/YuanKong hashes to EDR blocklists and run the 30-day retro-hunt. EDR-isolate any host that executed paperline.exe or fielddesk.exe.

24 Hours

  • For any host with QuartzLine execution or TraderTraitor C2 contact: treat all credentials on the host as compromised — force resets for interactive accounts, revoke sessions/refresh tokens, rotate browser-stored and keychain credentials, and invalidate API keys and cloud CLI tokens present on the machine.
  • DevOps-specific: if a targeted engineer's machine shows TraderTraitor indicators, rotate CI/CD secrets, cloud IAM keys, and audit Terraform state and pipeline run history for unauthorized changes (the actor persists in automation, not just endpoints).
  • Mobile fleet: scan managed Android devices for YuanKong package hashes; check for unauthorized accessibility-service grants and overlay permissions, its core credential-theft primitives.
  • Verify exposure/patch status for CVE-2025-11371.

1 Week

  • Third-party app governance: inventory all consented M365 enterprise applications, enforce admin consent workflows, apply least-privilege Graph scopes, and enable continuous access evaluation. The SkyKick incident is an MSP trust-chain failure — require vendor incident attestations.
  • Restrict dynamic-DNS categories at the proxy for all but approved business use; alert on cloud API endpoints contacted by non-browser, non-native-client processes (TraderTraitor's API-C2 pattern).
  • Enforce code-signing policy (WDAC/App Control) that does not treat EV certificates as inherently trusted; add revocation-aware signature checks for newly observed installers.
  • Harden CI/CD: require signed Terraform modules/pinning, run plan in sandboxed runners with no outbound internet, and alert on any shell child process of terraform.exe.
  • Brief mobile users on sideloading and overlay-permission risks; enforce MDM blocking of unknown-source APKs.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-credentialstradertraitorquartzline-backdoorm365-credential-abuseyuankong-ratinfostealer-campaigns

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action