← Actors

TraderTraitor

Intel Library

TraderTraitor

Threat actorKP1 report from 1 vendor· last reported 2026-09-18

TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.

Vendor aliases (3)

The same group is tracked under different names by different vendors.

VendorName
OSINTJade Sleet
OSINTUNC4899
OSINTPukchong

MITRE ATT&CK techniques (1)

T1071.001

Indicators of compromise

domainregistry.hashicorp-aws.com
domainregistry.hashicorp-aws.io
domainregistry.hashicorp-terraform.io
ipv4176.97.114.232
ipv445.11.59.140
ipv485.137.56.10
ipv485.137.56.245
domaingrenight.com
domainrelay.damus.io
hash1CD6D13FF15ADBF7A42025D10EC99B4A
domainapi.myip.com
domainregistry.terraform.io
domaintechnicais.sytes.net
domainstorage.hubpage.cloud
hash4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa
domain185-66-91-112.cprapid.com
domain213-111-146-132.cprapid.com
domainanesthesiaschool.com
domaindela.servehttp.com
domaintinklify.com
domainvaimage.com
domainwss.sytes.net
domainwww.anesthesiaschool.com
domainwww.tinklify.com
domainhashicorp-aws.com
domainhttps://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl
domainhttps://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl
domainhashicorp-aws.io
domainhttps://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl
domainhttps://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175
domainhashicorp-terraform.io
domainhttps://github.com/Steed-LHV/assessment

Top 32 by how many reports mention them.

Report timeline

Every report in the Global Intel Library that names TraderTraitor, newest first. Open any report to see the full analysis with provenance.

  1. SentinelOne2026-09-18
    Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
    T1071.001
    original

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TraderTraitor. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (4)

Open-source reports about this actor collected from MISP Galaxy.