North Korea-Linked Jade Sleet Targets Indian IT Services Organization Using macOS Backdoors
The North Korea-linked threat actor known as Jade Sleet has been linked to the compromise of an India-based IT services organization, highlighting the continued targeting of software developers and development environments as an entry point into corporate networks.
According to cybersecurity company SentinelOne, the campaign involved two macOS backdoors known as FLATROOF and ROOFDECK. Both malware families were previously associated with attacks targeting the cryptocurrency and blockchain sector.
Jade Sleet is also tracked under the names PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The group has a long history of targeting cryptocurrency and blockchain organizations, particularly for financially motivated attacks and cryptocurrency theft.
Developers Targeted Through Fake Job Interviews
The campaign relies heavily on social engineering techniques involving fake job interview and coding project opportunities.
Researchers said the attackers target individuals working in areas such as DevOps, cryptocurrency, and financial technology.
The attackers create GitHub repositories that appear to contain legitimate coding projects associated with the company they are impersonating. These repositories are designed to convince developers that they are part of a genuine technical interview or recruitment process.
Observed repositories include:
- gtn-candidate-repo
- Northwind-IAC
- novacart-interview
- terraform-candidate-repo
The projects are specifically designed around infrastructure engineering and development tasks.
Malicious Terraform Dependencies
A key component of the attack involves a weaponized Terraform dependency lock file named .terraform.lock.hcl.
The malicious file contains references to attacker-controlled domains, including domains designed to resemble legitimate HashiCorp infrastructure.
When an unsuspecting developer runs the standard terraform init command, Terraform can be directed to download attacker-controlled modules.
This allows the attackers to introduce malicious code into the developer's environment while making the activity appear to be part of a normal infrastructure deployment process.
The technique demonstrates how software development tools and dependency management systems can become an important part of modern supply chain attacks.
FLATROOF and ROOFDECK Backdoors
The attack ultimately deploys two Rust-based malware families targeting Apple Silicon macOS systems.
FLATROOF
FLATROOF is a macOS backdoor that uses Telegram for command-and-control communication.
Its capabilities include:
- Remote command execution
- File upload and download
- Data theft
- System reconnaissance
- Browser data collection
- Terminal history collection
- Installed application enumeration
- Hardware and software profiling
- Running process collection
- macOS Keychain data theft
The malware can use a Python-based component to collect information from browsers including Chrome, Brave, Firefox, and Safari.
It can also target the macOS login.keychain-db file, which can contain sensitive authentication information.
ROOFDECK
ROOFDECK is another Rust-based backdoor that uses the Nostr protocol for decentralized command-and-control communication.
Its capabilities include:
- System reconnaissance
- File manipulation
- Remote shell access
- Lateral movement
- Persistence
- Launch Agent installation
ROOFDECK also incorporates mechanisms designed to protect the integrity of commands received from the attacker.
According to SentinelOne, commands are digitally signed using the operator's private key. The malware verifies those commands using an embedded public key before executing them.
The backdoor also implements several common file and directory operations internally rather than relying entirely on standard shell commands.
Indian IT Services Company Compromised
During its investigation into FLATROOF and ROOFDECK, SentinelOne identified an additional victim that was not connected to the previously known cryptocurrency attacks.
The victim was an India-based IT services provider.
The initial compromise involved an Apple Silicon MacBook belonging to a DevOps engineer.
The backdoors were detected on the system as early as March 18, 2026, although researchers said the exact initial delivery mechanism remains unknown.
The malware remained dormant for several days.
According to SentinelOne, activity began on March 29, when the implants started beaconing and performing activity on the compromised system.
The implants were first launched by Cursor shortly after a development workspace named:
~/DevOps-Automation/cloudshield
was opened.
This indicates that the malware was closely connected to the victim's development workflow.
Updated ROOFDECK Variant Detected
Researchers also identified an updated version of ROOFDECK on the DevOps engineer's system on April 20, 2026.
The updated version reportedly removed previously installed ROOFDECK and FLATROOF binaries and stripped symbols and debugging information.
Removing these details can make reverse engineering and malware detection more difficult.
The timing is notable because the updated malware appeared one day after LayerZero publicly acknowledged the KelpDAO incident.
However, the available findings do not establish that the Indian IT services victim was directly connected to the KelpDAO attack.
Developer Endpoints Become High-Value Targets
The campaign highlights the growing importance of developer workstations in enterprise security.
Development systems frequently have access to sensitive resources including:
- Source code repositories
- Cloud infrastructure
- CI/CD pipelines
- Deployment credentials
- Infrastructure-as-code configurations
- Internal development environments
- API keys and authentication tokens
A compromise of a developer endpoint can therefore provide attackers with access beyond the individual workstation.
SentinelOne noted that attackers are increasingly targeting third parties and software supply chains because developer environments represent a significant point of exposure.
The use of customized development projects and victim-specific Terraform configurations also makes these campaigns more difficult to identify through traditional security controls.
Organizations should therefore strengthen security around developer endpoints, carefully review third-party repositories and dependencies, inspect Terraform configurations before execution, and apply strict controls to credentials and access tokens available from development machines.
The activity attributed to Jade Sleet demonstrates how attackers can combine social engineering, software supply chain techniques, malicious infrastructure-as-code dependencies, and macOS backdoors to target individual developers and potentially gain access to broader organizational environments.
