The North Korean threat actor Jade Sleet has compromised an India-based IT services firm through a DevOps engineer's MacBook, deploying sophisticated macOS malware designed to steal credentials and establish persistent access. Cybersecurity firm SentinelOne disclosed the attack in a report published this week, revealing that the breach employed the same backdoor tools used in the March-April 2026 attack on KelpDAO's LayerZero bridge. The campaign underscores how North Korean hackers continue to target software developers as entry points into cryptocurrency and blockchain organizations.
The intrusion involved two Rust-based malware families built for ARM-based macOS systems. FLATROOF is a backdoor that uses Telegram for command-and-control and can execute commands, upload and download files, and steal data through a Python module that harvests browser information from Chrome, Brave, Firefox, and Safari, Terminal command histories, installed application lists, system hardware and software profiles, snapshots of running processes, and copies of login.keychain-db. ROOFDECK is a second backdoor that relies on the Nostr protocol for decentralized command-and-control and offers capabilities including system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence through Launch Agents. The backdoors were first detected on the compromised MacBook on March 18, 2026, but stayed inactive until March 29, when they began communicating with attacker infrastructure and executing commands. The implants were initially launched by the Cursor code editor on March 29, seconds after the DevOps engineer opened a workspace directory called cloudshield. An updated version of ROOFDECK appeared on the system on April 20, 2026, one day after LayerZero publicly confirmed the KelpDAO hack, with the new variant removing existing malware binaries and stripping symbols and debug information to avoid detection.
The attack leverages social engineering through fake job interview scenarios, a common tactic used by multiple North Korean threat actors, to target job seekers at companies that become victims during the campaign. Targets typically work in DevOps, cryptocurrency, or financial technology roles. "The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as," SentinelOne researchers Albert Priego, Alex Delamotte, and Matej Havranek wrote. The malicious repositories include weaponized Terraform dependency lock files that point to attacker-controlled domains, causing the platform to download hostile modules when developers run the "terraform init" command. According to the report, ROOFDECK commands are signed with the operator's private key and verified using an embedded public key before execution, and the implant re-implements many common shell commands related to directory and file operations, a tactic often seen in more sophisticated North Korea-aligned toolsets including Lazarus' LightlessCan.
Jade Sleet has a track record of targeting the Web3 sector for cryptocurrency theft, with the group tied to the early 2025 theft of approximately $1.5 billion from Bybit's cold wallet infrastructure following a supply chain compromise of Safe{Wallet}'s developer environment. The group, also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, primarily focuses on users connected to cryptocurrency and blockchain organizations but also strikes vendors used by those firms. The newly disclosed Indian IT services provider breach illustrates how attackers gain access through third-party software supply chains, placing developer endpoints at the center of organizational risk. SentinelOne emphasized that endpoints used for development carry access to cloud infrastructure, pipelines, and source code, making monitoring and protection a high priority for organizations. The campaigns employ purpose-built development environments aimed at one engineer at a time, paired with backdoored Terraform builds that differ for each victim, allowing attackers to customize their approach and evade broad detection efforts. Organizations face mounting pressure to secure developer workstations that function as gateways to their most sensitive systems, rather than treating them as ordinary employee machines. The shift toward supply chain infiltration demands that security teams rethink perimeter defense and invest in endpoint visibility where code is actually written and deployed.