North Korea's Jade Sleet Hits Indian IT Provider With FLATROOF and ROOFDECK Backdoors

SentinelOne has attributed the compromise of a small Indian IT-services organization to the North Korean threat actor Jade Sleet. The case is one more reminder that, to breach a target network, these attackers go after developers.

The intrusion relied on two macOS backdoors, FLATROOF (also known as Gaslight) and ROOFDECK — the very tools that surfaced in the March–April 2026 attack on KelpDAO's LayerZero bridge. Jade Sleet, also tracked as PUKCHONG, Slow Pisces, TraderTraitor and UNC4899, has a long record of cryptocurrency theft in the Web3 space. In early 2025 it was tied to the theft of roughly $1.5 billion from Bybit's cold wallets after the developer environment of Safe{Wallet} was compromised.

The interview lure

The core technique is social engineering disguised as a job interview. Candidates working in DevOps, cryptocurrency or fintech are handed a coding task in the form of a GitHub repository dressed up as an infrastructure-engineering project of the company the actors are impersonating. Observed repositories include gtn-candidate-repo (used in the KelpDAO incident), Northwind-IAC, novacart-interview and terraform-candidate-repo.

Each repository carries a weaponized Terraform dependency lock file (.terraform.lock.hcl) pointing to malicious domains such as registry.hashicorp-aws[.]com. When an unsuspecting developer runs terraform init, the platform pulls attacker-controlled modules.

Two Rust backdoors

The chain ends with two Rust-based malware families aimed at ARM-based macOS systems. FLATROOF uses Telegram for command-and-control and can run commands, upload and download files, and — via a Python module — steal data from Chrome, Brave, Firefox and Safari, terminal command histories, installed-application lists, the system profile, a snapshot of running processes and a copy of login.keychain-db.

ROOFDECK builds a decentralized command channel over the Nostr protocol, offering reconnaissance, file manipulation, remote shell access, lateral movement and persistence via Launch Agents. Its commands are signed with the operator's private key and verified against an embedded public key before execution. SentinelOne notes that ROOFDECK re-implements many standard shell commands — a hallmark of more sophisticated North Korean toolsets, including Lazarus' LightlessCan.

The Indian victim

Hunting for the two backdoors led researchers to a further victim: an India-based IT-services provider compromised through an Apple Silicon MacBook belonging to a DevOps engineer. Traces were present as early as March 18, 2026, though the initial delivery method remains unknown. The implants stayed dormant until March 29, when Cursor launched them seconds after the cloudshield workspace was opened.

An updated ROOFDECK appeared on the engineer's machine on April 20, 2026 — a day after LayerZero publicly acknowledged the KelpDAO hack. The new variant deleted the earlier binaries and stripped symbols and debug information to evade detection.

SentinelOne's takeaway is blunt: attacks increasingly travel through third parties and their software supply chains, which puts the developer endpoint at the center of the defense — because that machine holds the keys to cloud, pipelines and source code.

Source: The Hacker News