North Korea's Jade Sleet Targets Indian IT Firm with macOS Backdoors FLATROOF and ROOFDECK
North Korean threat actor Jade Sleet has been linked to the compromise of an Indian IT services provider, deploying sophisticated macOS backdoors FLATROOF and ROOFDECK via social engineering and weaponized Terraform files.
The North Korean state-sponsored threat actor known as Jade Sleet has been implicated in the compromise of an India-based information technology services firm, continuing a pattern of targeting developers to infiltrate target networks. Cybersecurity company SentinelOne detailed the operation, which involved the deployment of two Apple macOS backdoors: FLATROOF, also known as Gaslight, and ROOFDECK. These backdoors were previously observed in a March-April 2026 attack targeting KelpDAO's LayerZero bridge.
Jade Sleet, also identified by aliases such as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a documented history of focusing on the Web3 sector to orchestrate cryptocurrency heists. Notably, in early 2025, the group was linked to the theft of approximately $1.5 billion from Bybit's cold wallet infrastructure, a breach that stemmed from a supply chain compromise of Safe{Wallet}'s developer environment. Microsoft-owned GitHub has previously noted Jade Sleet's primary focus on users within cryptocurrency and blockchain organizations, as well as the vendors supporting these firms.
The latest campaign leverages social engineering tactics, specifically employing job interview lures. This method, a common strategy adopted by various North Korean threat actors, targets individuals seeking employment in the DevOps, cryptocurrency, or financial technology sectors. The threat actors create deceptive GitHub repositories themed around coding projects, posing as legitimate infrastructure engineering initiatives of the companies they are impersonating. These repositories contain a weaponized Terraform dependency lock file (.terraform.lock.hcl) that points to malicious domains. When an unsuspecting developer runs the 'terraform init' command, the platform is tricked into downloading attacker-controlled modules.
The attack chain culminates in the deployment of two distinct Rust-based malware families designed to target ARM-based macOS systems. FLATROOF functions as a backdoor that communicates with its command-and-control (C2) infrastructure via Telegram. It is capable of executing commands, uploading and downloading files, and exfiltrating data. A Python module within FLATROOF is designed to collect sensitive information from Chrome, Brave, Firefox, and Safari browsers, as well as Terminal command histories, lists of installed applications, system hardware and software profiles, running processes, and a copy of the login.keychain-db file.
ROOFDECK, the second backdoor deployed, utilizes the decentralized Nostr protocol for its C2 communications, making it more resilient to takedown efforts. This malware is equipped to perform system reconnaissance, manipulate files, provide remote shell access, facilitate lateral movement within the network, and establish persistence through Launch Agents. SentinelOne researchers noted that ROOFDECK commands are cryptographically signed with the operator's private key, and their integrity is verified using an embedded public key before execution. The implant's functionalities are modular, with distinct handlers for different command types, and it re-implements common shell commands, a characteristic observed in sophisticated North Korean toolsets like Lazarus's LightlessCan.
During their investigation into FLATROOF and ROOFDECK, SentinelOne's threat hunters identified an additional, unrelated victim: an IT services provider based in India. This compromise occurred via an Apple Silicon MacBook belonging to a DevOps engineer. While the exact delivery mechanism remains unclear, the backdoors were detected on the engineer's machine as early as March 18, 2026, with malicious activity and beaconing commencing on March 29, shortly after the 'cloudshield workspace' was opened.
Evidence suggests that ROOFDECK is deployed as a secondary tool after an initial foothold has been established. An updated version of ROOFDECK was deployed on the compromised DevOps engineer's system on April 20, 2026, coincidentally the day after LayerZero publicly acknowledged the KelpDAO hack. This updated variant included measures to evade detection, such as removing symbols and debug information, alongside the removal of existing FLATROOF and ROOFDECK binaries.
SentinelOne emphasized that these threat actors' initial access strategies increasingly involve targeting third parties and their software supply chains, shifting the primary attack surface to the developer endpoint. Development endpoints often possess extensive access to cloud resources, CI/CD pipelines, and source code, making their monitoring and protection paramount. The observed campaigns utilize highly customized development environments tailored for individual engineers and employ backdoored Terraform builds that are unique to each victim, underscoring the sophisticated and targeted nature of Jade Sleet's operations.