North Korean threat actor Jade Sleet has been linked to the compromise of a smaller India-based organization in the IT services industry, according to SentinelOne. The intrusion involved two Apple macOS backdoors, FLATROOF (also known as Gaslight) and ROOFDECK, both previously seen in the March-April 2026 attack on KelpDAO's LayerZero bridge.
Jade Sleet, also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a history of targeting Web3 organizations for cryptocurrency theft. In early 2025, the group was tied to the theft of roughly $1.5 billion from Bybit's cold wallet infrastructure after a supply chain compromise of Safe{Wallet}'s developer environment.
The campaign relies on social engineering through job interview lures aimed at job seekers in DevOps, cryptocurrency, and financial technology. SentinelOne researchers Albert Priego, Alex Delamotte, and Matej Havranek said the GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company the DPRK actors are posing as. Repositories observed include gtn-candidate-repo, used in the KelpDAO incident, along with Northwind-IAC, novacart-interview, and terraform-candidate-repo.
These repositories contain a weaponized Terraform dependency lock file, .terraform.lock.hcl, pointing to malicious domains such as registry.hashicorp-aws[.]com, causing the platform to download attacker-controlled modules when a developer runs terraform init.
The chain ends with two Rust-based malware families for ARM-based macOS systems. FLATROOF uses Telegram for command-and-control and can execute commands, upload and download files, and steal data through a Python module that collects browser data from Chrome, Brave, Firefox, and Safari, Terminal command histories, installed application listings, system hardware and software profiles, running processes, and a copy of login.keychain-db. ROOFDECK uses the Nostr protocol for decentralized C2 and can perform system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents.
ROOFDECK commands are signed with the operator's private key and verified using an embedded public key before execution, with functionalities split into distinct handlers. The implant re-implements many common shell commands for directory and file operations, a tactic SentinelOne noted appears in more sophisticated North Korea-aligned toolsets, including Lazarus' LightlessCan.
SentinelOne's hunt uncovered an additional unrelated victim: an India-based IT services provider compromised through an Apple Silicon MacBook belonging to a DevOps engineer. The backdoors were detected on the machine as early as March 18, 2026, though the exact delivery mechanism is unknown. They remained dormant until March 29, when beaconing and host activity began. The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace was opened.
Evidence indicates ROOFDECK is deployed as a follow-up tool after initial foothold and control. An updated ROOFDECK version was deployed on the engineer's system on April 20, 2026, a day after LayerZero publicly acknowledged the KelpDAO hack. The new variant removes the existing ROOFDECK and FLATROOF binaries and strips symbols and debug information to evade detection.
SentinelOne said these groups' initial access efforts include targeting third parties and their software supply chain, putting the developer endpoint at the center of defense. Endpoints used for development carry access to cloud, pipelines, and source code, making monitoring and protection a high priority. The campaigns use purpose-built development environments aimed at one engineer at a time, paired with backdoored Terraform builds that differ for each victim.
Source: The Hackers News