The North Korean threat actor known as **Jade Sleet** has been attributed to the compromise of an India-based IT services organization. This incident once again highlights the adversary's persistent strategy of targeting developers to gain access to broader networks. Cybersecurity firm **SentinelOne** disclosed details of the activity, which involved the use of **Apple macOS** backdoors tracked as **FLATROOF** (also known as **Gaslight**) and **ROOFDECK**. Both malware families were previously observed in a March-April 2026 attack on **KelpDAO's LayerZero** bridge. ## Jade Sleet's Modus Operandi **Jade Sleet**, also tracked under monikers such as **PUKCHONG**, **Slow Pisces**, **TraderTraitor**, and **UNC4899**, has a documented history of targeting the Web3 sector for cryptocurrency heists. In early 2025, the group was tied to the theft of approximately $1.5 billion from **Bybit's** cold wallet infrastructure, following a supply chain compromise of **Safe{Wallet}**'s developer environment. **Microsoft**-owned **GitHub** noted in July 2023 that "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms." ## Social Engineering and Malicious Repositories **SentinelOne** reports that the current campaign employs social engineering tactics, utilizing job interview lures. This is a common strategy adopted by multiple North Korean threat actors to target job seekers from companies that are subsequently breached. Targeted individuals typically work in DevOps, cryptocurrency, or financial technology. Security researchers Albert Priego, Alex Delamotte, and Matej Havranek stated, "The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as." Some of the observed malicious repositories include: * `gtn-candidate-repo` (used in the KelpDAO incident) * `Northwind-IAC` * `novacart-interview` * `terraform-candidate-repo` These repositories contain a weaponized **Terraform** dependency lock file (`.terraform.lock.hcl`) that points to malicious domains (e.g., `registry.hashicorp-aws[.]com`). When an unsuspecting developer runs the `terraform init` command, the platform is tricked into downloading attacker-controlled modules. ## Sophisticated macOS Backdoors The attack chain culminates in the deployment of two **Rust**-based malware families specifically targeting **ARM**-based **macOS** systems: * **FLATROOF**: This backdoor uses **Telegram** for command-and-control (C2) and is capable of command execution, file upload and download, and data theft. A Python module within **FLATROOF** can collect browser data (Chrome, Brave, Firefox, Safari), Terminal command histories, installed application listings, system hardware and software profiles, a snapshot of running processes, and a copy of `login.keychain-db`. * **ROOFDECK**: This backdoor utilizes the **Nostr** protocol for decentralized C2. Its capabilities include system reconnaissance, file manipulation, remote shell access, lateral movement, and establishing persistence via Launch Agents. **SentinelOne** explained, "ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution. The command functionalities are separated into distinct handlers in the source code." They added, "The implant re-implements many common shell commands related to directory and file operations, another tactic often used in more sophisticated North Korea-aligned toolsets, including **Lazarus' LightlessCan**." ## Uncovering Additional Victims **SentinelOne's** investigation into these backdoors uncovered an additional unrelated victim: an IT services provider based in India. This compromise occurred via an **Apple Silicon MacBook** belonging to a DevOps engineer. The backdoors were detected on the machine as early as March 18, 2026, though the precise delivery mechanism remains unknown. Researchers noted, "They remained dormant until March 29, when beaconing and host activity began. The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace [~/DevOps-Automation/cloudshield] was opened." Evidence suggests that **ROOFDECK** is deployed as a follow-up tool after initial foothold and control are established. An updated version of **ROOFDECK** was deployed on the DevOps engineer's system on April 20, 2026, a day after **LayerZero** publicly acknowledged the **KelpDAO** hack. This new variant removed existing **ROOFDECK** and **FLATROOF** binaries and stripped symbols and debug information, likely to evade detection. ## The Developer Endpoint: A Critical Target **SentinelOne** emphasized the critical role of developer endpoints in modern cyber defense: "These groups' initial access efforts include targeting third parties and their software supply chain, which is where much of the industry’s exposure has moved, putting the developer endpoint at the center of the defense." Endpoints used for development often have access to cloud environments, CI/CD pipelines, and source code, making their monitoring and protection a high priority for organizations. These campaigns are characterized by purpose-built development environments, tailored for individual engineers, paired with backdoored **Terraform** builds unique to each victim.