TraderTraitor ROOFDECK command-and-control servers and FLATROOF stagers (Lazarus)

The main anchor is the certificate authority name 'mkcert ub@ub-Standard-PC-Q35-ICH9-2009'. Every ROOFDECK server in the report shares it while each server has its own certificate and key, so it survives a change of address or domain, and a new authority made on the same machine keeps the name. A second term watches for an authority named after the workstations 'halid-Raider-GE78-HX-14VIG' and 'Raider-GE78-HX-14VIG' that appear in the leaf certificates. On 2026-11-07, 213.111.148[.]242 still served a certificate from this authority, itcy-sysvalidatorit[.]shop behind Cloudflare gave the same JSON reply, and the font-shaped stage files on the GitHub repository bluearuhost/hospitalrun-frontend and on stage-fashion365.vercel[.]app were still online. Only addresses with no sign of a new tenant are included: several other addresses from the report sit on shared virtual-server ranges and already serve unrelated sites. The JSON reply on its own is the default of a common web framework and is not a match condition. The attribution to TraderTraitor follows the vendor reports; one public reply to the report disputed it without giving evidence.