Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

SentinelOne has identified a second victim of the FLATROOF and ROOFDECK macOS backdoors — an IT services provider based in India with no cryptocurrency ties — linking the intrusion to Jade Sleet, the North Korean threat group also tracked as TraderTraitor, UNC4899, Slow Pisces and PUKCHONG.

The finding is significant because it shows a toolset built for cryptocurrency heists being deployed against a mainstream IT provider, expanding the group's apparent targeting beyond the Web3 sector.

Who Jade Sleet Is

Jade Sleet is a financially motivated subgroup of North Korea's Lazarus Group. It specialises in targeting software developers and Web3 engineers through fake job interview lures, then using the access gained to steal cryptocurrency.

Its track record is substantial. In early 2025 the group was linked to the theft of approximately $1.5 billion from Bybit's cold wallet infrastructure after compromising Safe{Wallet}'s developer environment. In April 2026, it stole $292 million from KelpDAO by compromising infrastructure connected to the LayerZero bridge, faking a crypto minting event and hitting validation servers with a DDoS.

FLATROOF and ROOFDECK first appeared in that LayerZero attack.

The Indian IT Provider Breach

The victim is described by SentinelOne as a "much smaller organisation" in the Indian IT services sector. The affected endpoint was an Apple Silicon MacBook belonging to a DevOps engineer — a machine used for Terraform, Ansible, AWS, OVH and OpenStack administration, and therefore carrying cloud credentials, source code access and infrastructure permissions.

The backdoors were present on the machine as early as March 18, 2026. They lay dormant for eleven days before activating on March 29, when the engineer opened a DevOps workspace inside the Cursor IDE. Both implants were launched from directories designed to resemble Apple system components, seconds after the cloudshield workspace was opened.

The Delivery Method: Contagious Interview

Jade Sleet used its established social-engineering technique, known as Contagious Interview, to reach the DevOps engineer.

The method targets job seekers, primarily DevOps and FinTech engineers. Attackers make contact, pose as recruiters, and send GitHub repositories disguised as coding assignments. The victim is asked to clone and run the repository as part of the interview process.

In this case, the weaponised vector was a Terraform lock file — specifically a malicious .terraform.lock.hcl file embedded in the fake repository. Terraform uses this file to pin provider versions. The attacker embedded references to a typosquatted provider domain within it. When the victim ran terraform init to set up the project, Terraform automatically fetched and executed the attacker-controlled code.

This is an attack on trusted developer workflow rather than a software vulnerability. The developer is doing exactly what their job requires, and the malicious code arrives as a dependency.

On April 13, the engineer cloned a separate terraform-candidate-repo through GitHub Desktop, indicating the social-engineering operation ran across multiple lure repositories.

FLATROOF: The Initial Foothold

FLATROOF, also tracked as macOS.Gaslight, is an ARM64 Rust backdoor for macOS deployed as SystemUpdate in ~/Library/com.apple.iTunesCloud/.

Its primary function is initial data collection. It uses Telegram for command-and-control and is capable of command execution, file upload and download, and data theft via a Python module.

What it collects: Chrome, Brave, Firefox and Safari browser data; Terminal command histories; installed application listings; system hardware and software profile; a snapshot of running processes; and a copy of login.keychain-db, which holds saved passwords and credentials.

FLATROOF also handles operational preparation. It removes the quarantine attribute from ROOFDECK, sets the executable bit, and arms it for launch. FLATROOF's beaconing is gated on Cursor sessions — it goes quiet when the IDE is closed, which helps it blend into normal developer activity patterns.

ROOFDECK: The Advanced Persistent Tool

ROOFDECK is the more capable implant, deployed as a follow-on after FLATROOF establishes initial footing and control.

Its command set covers system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents. Its endpoint scheduler can rotate between a C2-supplied direct domain table, four embedded IPv4 fallback addresses, and four .onion addresses reached through a dynamically delivered Tor module.

The distinctive architectural feature is its C2 discovery mechanism. Rather than hardcoding a C2 server address, ROOFDECK searches Nostr relays for attacker-controlled profiles. Nostr is a legitimate decentralised social networking protocol. The operator publishes the active C2 location to a Nostr profile, and ROOFDECK reads it at runtime.

This is similar in concept to the Polygon blockchain technique used by ChainScript, and for the same reason: a published address on a decentralised protocol cannot be taken down through conventional means. There is no registrar to contact, no hosting provider to notify. The profile can be updated at any time to rotate infrastructure.

ROOFDECK enforces signed commands. Commands are signed with the operator's private key and their integrity is verified against an embedded public key before execution. This prevents interference in the C2 channel and confirms the operator is authentic.

The Operational Timeline

March 18: FLATROOF and ROOFDECK present on the machine.

March 29: Both implants activate after the Cursor IDE opens the cloudshield workspace.

April 13: Engineer clones terraform-candidate-repo through GitHub Desktop.

April 14, 18:25: FLATROOF re-arms ROOFDECK.

April 19: LayerZero publicly acknowledges the KelpDAO hack.

April 20: An updated, stripped version of ROOFDECK is deployed. The new variant removes existing FLATROOF and ROOFDECK binaries, then strips symbols and debug information to evade analysis. It stages a third-stage loginwindow binary and deletes both original implants at 13:15. The new binary beacons to grenight[.]com until June 1.

The update arriving one day after the LayerZero disclosure is timing that is almost certainly not coincidental — the operators were cleaning house immediately after their other campaign became public knowledge.

Why the Non-Crypto Victim Matters

Every previous Jade Sleet campaign SentinelOne has documented targeted cryptocurrency organisations. This one targeted an IT services provider with no crypto involvement.

The operational logic is clear: a DevOps engineer at an IT provider holds cloud credentials, source code repositories, and infrastructure permissions that can be pivoted into client environments. The LayerZero attack demonstrated exactly that path — initial compromise of a developer endpoint, collection of API keys, escalation into AWS and Google Cloud Platform environments.

For IT providers and their clients, the implication is direct. The social-engineering lure is indistinguishable from a legitimate recruiter outreach to a developer. The weaponised repository looks like a coding exercise. The malicious Terraform lock file exploits a trusted workflow, not a vulnerability. Technical controls alone are insufficient without awareness of the lure pattern.

Sources: SentinelOne, The Hacker News, GBHackers, CyberPress, Technobezz