INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF

| 2026-09-19 08:44 MEDIUM HIGH DATA BREACH MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
 Ravie Lakshmanan  Sep 21, 2026 Malware / Social Engineering The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 10 IoCs Create Free Account
gr•••••.com
st•••••.cloud
re•••••.com
te•••••.net
c491d4••••••••••••••••••••••••••••••••••
77b4fd••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
45.11.•••.•••
85.137.•••.•••
176.97.•••.•••
d95ded••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
DPRK DPRK NORTH_AMERICA NORTH_AMERICA cryptocurrencycryptocurrency technologytechnology
Incident Timeline
‎July 2023
Threat actors, primarily targeting users associated with cryptocurrency and blockchain-related organizations, used compromised GitHub accounts to target vendors of those firms.
organisation Microsoft
"Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms," Microsoft-owned GitHub noted in July 2023.
‎early 2025
The hacking group tied to the $1.5 billion theft from Bybit's cold wallet infrastructure resurfaced on a victim with no crypto ties in early 2025.
organisation Bybit
In early 2025, the hacking group was tied to the theft of about $1.5 billion from Bybit's cold wallet infrastructure following a supply chain compromise of Safe{Wallet}'s developer environment.
‎March 18, 2026
The backdoors, previously detected on the machine as early as March 18, 2026, were found to have resurfaced without any apparent connection to cryptocurrency transactions.
industry Technology
General Document Context
‎March 29, seconds
Cursor launched implants seconds after the cloudshield workspace was created on March 29.
infrastructure Cursor
"The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace
‎March 29
Threat actors reactivated dormant backdoors on a victim's system, as indicated by increased beaconing and host activity starting March 29.
‎April 20, 2026
An updated version of the ROOFDECK backdoor was deployed on a DevOps engineer's system on April 20, 2026.
industry Technology
General Document Context
‎June 2026
Threat actors continued to target a victim with no crypto ties until June 2026, after which they ultimately abandoned the intrusion.
‎March-April 2026
Threat actors used Apple macOS backdoors FLATROOF and ROOFDECK to target a victim, which was previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge.
infrastructure Macos
Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
organisation FLATROOF
Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
organisation Cybersecurity company SentinelOne
Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
organisation Apple
Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
‎2026/09/19
TraderTraitor, a North Korean threat actor attributed to Jade Sleet, used fake job interview lures containing weaponized Terraform coding projects to target DevOps engineers in India.
organisation Apple Silicon MacBook
" The cybersecurity company said its hunt for the two backdoors uncovered an additional unrelated victim, an IT services provider based in India that was compromised through an Apple Silicon MacBook belonging to a DevOps engineer.
organisation LightlessCan
"The implant re-implements many common shell commands related to directory and file operations, another tactic often used in more sophisticated North Korea-aligned toolsets, including Lazarus' LightlessCan .
organisation SentinelOne
SentinelOne said the campaign employs social engineering using job interview lures, a common tactic adopted by multiple North Korean threat actors , to target job seekers from the companies that are breached over the course of the attack.
organisation DevOps
Targeted individuals have been found to work in the DevOps, cryptocurrency, or financial technology space.
The compromise involved a DevOps engineer targeted through fake job interview lures containing weaponized Terraform coding projects.
organisation TraderTraitor
In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO.
financial $292 theft
In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO.
infrastructure Macos
Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init.
The attack chain culminates in the deployment of two Rust-based malware families targeting ARM-based macOS systems - FLATROOF, a backdoor that uses Telegram for command-and-control (C2) and is capable of command execution, file upload and download, and data theft via a Python module that can collect Chrome, Brave, Firefox, and Safari browser data, Terminal command histories, installed appl…
organisation FLATROOF
Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init.
organisation ROOFDECK
Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init.
…irefox, and Safari browser data, Terminal command histories, installed application listings, system hardware and software profile, a snapshot of running processes, and a copy of login.keychain-db ROOFDECK, a backdoor that uses the Nostr protocol for decentralized C2 and is capable of system reconnaissance, file manipulation, remote shell access, lateral movement, and establishing persistenc…
organisation Terraform
The compromise involved a DevOps engineer targeted through fake job interview lures containing weaponized Terraform coding projects.
Some of the repositories observed are listed below - gtn-candidate-repo (used in the KelpDAO incident) Northwind-IAC novacart-interview terraform-candidate-repo The repositories include a weaponized Terraform dependency lock file (".terraform.lock.hcl") pointing to malicious domains (e.g., "registry.hashicorp-aws[.]com") that causes the platform to download attacker-controlled mo…
organisation Northwind-IAC
Some of the repositories observed are listed below - gtn-candidate-repo (used in the KelpDAO incident) Northwind-IAC novacart-interview terraform-candidate-repo The repositories include a weaponized Terraform dependency lock file (".terraform.lock.hcl") pointing to malicious domains (e.g., "registry.hashicorp-aws[.]com") that causes the platform to download attacker-controlled mo…
organisation GitHub
"The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as," security researchers Albert Priego, Alex Delamotte, and Matej Havranek said.
organisation Chrome, Brave
…systems - FLATROOF, a backdoor that uses Telegram for command-and-control (C2) and is capable of command execution, file upload and download, and data theft via a Python module that can collect Chrome, Brave, Firefox, and Safari browser data, Terminal command histories, installed application listings, system hardware and software profile, a snapshot of running processes, and a copy of logi…
organisation Terminal
…egram for command-and-control (C2) and is capable of command execution, file upload and download, and data theft via a Python module that can collect Chrome, Brave, Firefox, and Safari browser data, Terminal command histories, installed application listings, system hardware and software profile, a snapshot of running processes, and a copy of login.keychain-db ROOFDECK, a backdoor that uses th…
organisation Launch Agents
…and a copy of login.keychain-db ROOFDECK, a backdoor that uses the Nostr protocol for decentralized C2 and is capable of system reconnaissance, file manipulation, remote shell access, lateral movement, and establishing persistence via Launch Agents "ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution.
organisation PUKCHONG
Jade Sleet, also tracked under the monikers PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a history of targeting the Web3 sector for cryptocurrency heists.
organisation Slow Pisces
Jade Sleet, also tracked under the monikers PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a history of targeting the Web3 sector for cryptocurrency heists.
organisation UNC4899
Jade Sleet, also tracked under the monikers PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a history of targeting the Web3 sector for cryptocurrency heists.
organisation ~/DevOps-Automation
[~/DevOps-Automation/cloudshield] was opened.
‎Sep 21, 2026
TraderTraitor backdoors were resurfaced on a victim's system without any apparent cryptocurrency ties.
industry Technology
General Document Context
Tactical Metrics
Metrics
financial
292,000,000
Theft
In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO.
Metrics
infrastructure
‎Macos
Affected Product
Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init.
The attack chain culminates in the deployment of two Rust-based malware families targeting ARM-based macOS systems - FLATROOF, a backdoor that uses Telegram for command-and-control (C2) and is capable of command execution, file upload and download, and data theft via a Python module that can collect Chrome, Brave, Firefox, and Safari browser data, Terminal command histories, installed appl…
Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight ) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge .
Metrics
infrastructure
‎Cursor
Affected Product
"The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace
Intelligence Sources
The Hacker News 2026-09-21
AlienVault OTX 2026-09-19