OAK — OnChain Attack Knowledge

Software · OAK-S08 · malware

OAK-S08 — TraderTraitor

Type
malware
Aliases
TraderTraitor (FBI / CISA naming for the DPRK cross-platform job-lure trojan family); naming overlaps with the broader FBI-tracked DPRK-crypto-theft operator label of the same name (the malware family and the operator-cluster nomenclature were aligned by the U.S. government in the April 2022 advisory rather than separated). Industry-side aliases for related/derived loaders include "JS_TraderTraitor" (npm-package-delivery variants), "ManuscryptCrypto" sub-family overlaps as documented by Kaspersky and Mandiant, and "Hidden Risk" / "RustBucket" successors tracked separately by SentinelOne and Jamf for macOS evolution.
Active
yes
First observed
2022-04 (CISA AA22-108A canonical advisory date; underlying campaign activity tracked by FBI from 2020 forward).
Used by Groups
OAK-G01 (Lazarus / TraderTraitor cluster — confirmed via FBI / CISA / Treasury joint advisory).
Host platforms
cross-platform (macOS-focused — both Intel and Apple Silicon builds documented; Windows builds also distributed via the same lure infrastructure; Linux builds reported in narrower vendor-corroborated cases).
Observed Techniques
OAK-T11.001 (third-party signing/custody-vendor compromise, where the TraderTraitor lure delivers initial-access payload onto a vendor developer workstation), OAK-T11.002 (wallet-software distribution compromise, where TraderTraitor variants are themselves the trojanized "trading app" delivered to crypto-firm engineering staff). Pre-incident social-engineering vectors (LinkedIn / Telegram fake-job-offer payload delivery) sit outside OAK v0.1 on-chain Tactic scope but are the defining entry surface.

Description

TraderTraitor is the FBI / CISA naming for a cross-platform trojanized-trading-app malware family attributed to DPRK cyber-actors operating within the OAK-G01 Lazarus / APT38 cluster. The family targets engineering staff at cryptocurrency exchanges, custody vendors, decentralised-finance protocols, and crypto-infrastructure firms via fabricated recruiter outreach (predominantly LinkedIn but also Telegram, Discord, and Korean-job-board surfaces) followed by delivery of a payload disguised as a legitimate trading-tool, portfolio-tracker, or job-related "coding test" application. The canonical reference is the joint FBI / CISA / Treasury advisory AA22-108A of April 18, 2022 ([cisaaa22108a]), which named the operator-cluster and the family in a single document and remains the U.S.-government anchor for confirmed-grade attribution.

Infection vector is social-engineering-led: an operator under a fabricated recruiter or technical-counterparty persona builds rapport with a target over days-to-weeks before delivering a download link or attachment. Post-compromise behavior is staged — initial-access payloads run reconnaissance and credential-and-keychain harvesting (browser-stored crypto credentials, MetaMask vault artifacts, Apple Keychain entries, iCloud session tokens, SSH keys, AWS / GCP credential files) and stage second-stage backdoors (RustBucket / KandyKorn / SwiftLoader on macOS; Manuscrypt-family loaders on Windows) for persistent access. The operational role of TraderTraitor in the DPRK financial-funding chain is initial access into the crypto-firm perimeter; downstream movement into signing-infrastructure, multisig-vendor workstations, and cold-wallet-adjacent systems then enables the canonical OAK-G01 supply-chain-compromise extraction pattern documented across Bybit (Feb 2025), WazirX (Jul 2024), DMM Bitcoin (May 2024), Radiant Capital (Sep 2024), and earlier custody-vendor incidents.

The family is the operationally dominant DPRK initial-access vector against the crypto industry from 2022 forward and is the malware-side anchor of the FBI's "TraderTraitor" operator-cluster naming. From a defender perspective the appropriate model is one entry vector, many extraction outcomes: the same TraderTraitor-family lure-and-payload tradecraft has been the documented entry surface for incidents whose on-chain extraction Tactics range from third-party-vendor signing-infrastructure compromise (T11.001) through multisig-contract manipulation (T11.003) and wallet-software distribution compromise (T11.002).

Observed examples

  • Bitcoin.DMM.com (May 2024, ~$308M). FBI / DC3 / Japan NPA joint identification of December 23, 2024 ([fbidmm2024]) attributed the theft to the TraderTraitor cluster; reporting indicates a Ginco (custody-software-vendor) employee was the entry point via a TraderTraitor-aligned social-engineering payload, leading to manipulation of legitimate transaction-signing requests. Confirmed-grade attribution.
  • Radiant Capital (September 2024, ~$50M+). Mandiant attribution to UNC4736 / AppleJeus / Citrine Sleet ([mandiantradiant2024]) — the entry vector was a TraderTraitor-aligned macOS payload delivered to a Radiant engineer under a fabricated recruiter persona. Inferred-strong attribution per Mandiant (DPRK-nexus high confidence).
  • Multiple custody-vendor compromises feeding the OAK-G01 incident list (2022–2025). Bybit (Feb 2025) and WazirX (Jul 2024) post-mortems document the entry vector for both as a vendor-side developer workstation compromise consistent with the TraderTraitor pattern, though per-incident TraderTraitor-family naming is not always made explicit in public reporting. Inferred-strong with named industry-forensic source (Mandiant / SlowMist / Chainalysis).
  • CISA AA22-108A campaign cohort (April 2022). The advisory itself bundles multiple campaigns as the TraderTraitor evidence base, documenting trojanized portfolio-tracker, trading-bot, and cryptocurrency-tax tools used as lures throughout 2020–2022. Confirmed-grade.

Detection / attribution signals

Defenders should treat TraderTraitor-family detection as a multi-surface problem because the family rotates payload formats but reuses delivery and persistence patterns:

  • Lure-channel telemetry — anomalous LinkedIn / Telegram recruiter outreach to engineering staff with subsequent download-link or "coding test" delivery; this is the highest-yield top-of-funnel signal and is the surface CISA AA22-108A specifically calls out.
  • macOS-side process-tree fingerprints — unsigned or ad-hoc-signed binaries executing under Apple-developer-tool naming masquerades; persistence via LaunchAgents plist files written into ~/Library/LaunchAgents/ with non-standard label naming; child processes invoking osascript, curl, or python3 with base64-encoded staging from memory (the RustBucket / KandyKorn / SwiftLoader successors all fit this pattern).
  • Windows-side process-tree fingerprints — Electron-app or NodeJS-runtime parents launching cmd.exe / PowerShell.exe with download-and-execute sequences; persistence via Run-key or Scheduled Task registration under naming that mimics legitimate productivity tools.
  • C2-domain naming patterns — domains mimicking crypto-firm careers / recruiting / portfolio / tax / trading-bot brands; CISA AA22-108A and subsequent vendor reporting publish indicator-of-compromise lists that should be consumed via threat-intel feeds rather than transcribed (specific hashes and IOCs change per campaign and are best obtained from CTI vendor feeds — Mandiant, CrowdStrike, SentinelOne, Jamf, Volexity, and CISA itself).
  • Behavioral signatures from CTI vendors — SentinelOne (RustBucket / KandyKorn detections), Jamf Threat Labs (macOS-specific TraderTraitor / Hidden Risk detections), Mandiant (UNC4736 / AppleJeus convergence rules), Microsoft (Citrine Sleet rules in Defender for Endpoint).
  • Cross-correlation with on-chain cluster watchlists — a workstation compromise consistent with TraderTraitor on a vendor whose downstream signing key reaches into a crypto-firm cold-wallet path raises the prior on a subsequent OAK-T11.001 / T11.003 extraction event; integrating endpoint-detection telemetry with on-chain G01-cluster watchlists is a defender-grade compounding control.

Note: omit specific file hashes from this entry. Defenders should consume current IOCs from CISA AA22-108A's published indicator list and from the live CTI-vendor feeds named above.

Citations

  • [cisaaa22108a] — CISA / FBI / Treasury joint advisory AA22-108A, April 18, 2022, "TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies." Primary U.S.-government confirmed-grade anchor for the family and the operator-cluster naming.
  • [fbidmm2024] — FBI / DC3 / Japan NPA joint identification, December 23, 2024, attributing the May 2024 DMM Bitcoin theft to the TraderTraitor cluster.
  • [mandiantradiant2024] — Mandiant attribution of the September 2024 Radiant Capital compromise to UNC4736 / AppleJeus / Citrine Sleet (the macOS-side successor lineage that operates alongside the TraderTraitor branding).
  • [chainalysis2024dprk] — DPRK-attributed cryptocurrency-theft scale; 2024 / 2025 aggregates that the TraderTraitor entry vector explains a substantial fraction of.
  • [chainalysisdprktradertraitor] — Chainalysis cross-incident TraderTraitor activity context.

Discussion

On lineage. TraderTraitor sits within the broader DPRK-attributed macOS-and-cross-platform malware lineage that begins with AppleJeus (OAK-S09) in 2018. The lineage progression — AppleJeus → TraderTraitor (2022 advisory naming) → RustBucket / KandyKorn / SwiftLoader / Hidden Risk macOS successors (2023–2025) — represents a sustained evolution of the trojanized-trading-app vector with stable operator continuity but rotating implementation languages (Objective-C → Swift → Rust → cross-platform Electron). For attribution purposes the vector is what defenders should track; the implementation is what CTI vendors track.

On the family / operator naming overlap. The U.S. government's choice in AA22-108A to name both the malware family and the operator cluster "TraderTraitor" was deliberate — it signals that the cluster is operationally identified by the lure-and-payload pattern more than by any single piece of code. This is methodologically different from the conventional separation between e.g. an APT group and a specific RAT family it uses; defenders should accept the conflation as the U.S.-government-canonical framing rather than try to separate them.

On attribution caveats. Cluster-level attribution to DPRK / Lazarus is confirmed (CISA / FBI / Treasury / OFAC; multi-government corroboration including Japan, Republic of Korea, and Germany via the broader DPRK advisory cohort). Per-incident attribution that a specific compromise used TraderTraitor as the entry vector is in many cases inferred-strong — public post-mortems often document only that the entry was a "social-engineering payload delivered via LinkedIn" without further family-naming. Defenders should treat the absence of explicit TraderTraitor naming in a post-mortem as not-evidence-of-absence given the dominance of the family in the DPRK-against-crypto-industry intrusion set 2022 forward.

On ecosystem position. TraderTraitor is the initial-access node in the DPRK financial-funding chain. Downstream from initial access, the chain runs through OAK-G01-attributed extraction Techniques (T10.001, T11.001, T11.002, T11.003) and OAK-T7-Tactic laundering (T7.001 mixer-routed-hop, T7.003 cross-chain-bridge — with THORChain emerging as the dominant post-Tornado-Cash rail, see [coindeskthorchainlazarus2025]). A defender control program targeting TraderTraitor at the initial-access layer compounds with on-chain G01-cluster watchlists at the off-ramp layer; either alone is partial coverage.

Techniques observed (2)

Used by