A North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based IT services provider, where attackers deployed two previously observed macOS backdoors, FLATROOF and ROOFDECK.
The campaign targeted developers and used social engineering alongside malicious development infrastructure to gain access to victim systems.
Who Is Jade Sleet Targeting?
The threat group, also tracked as UNC4899, has a history of targeting the Web3 sector for cryptocurrency theft. It was linked in early 2025 to the theft of about $1.5 billion from Bybit’s cold wallet infrastructure following a supply-chain compromise of Safe{Wallet}’s developer environment.
The group primarily targets users associated with cryptocurrency and other blockchain-related organisations. It also targets vendors used by those companies. Microsoft-owned GitHub was notified in July 2023 about activity connected to the group.
How Are Developers Being Targeted?
The campaign uses social engineering through job interview lures, a tactic adopted by multiple North Korean threat actors to target job seekers from companies that are ultimately breached.
Individuals have been found working in DevOps, cryptocurrency or financial technology roles.
GitHub repositories used as lures are designed to appear like infrastructure engineering projects connected to the company that the attackers are posing as. Observed repositories included gtn-candidate-repo, Northwind-IAC, novacart-interview and terraform-candidate-repo.
How Does the Malicious Code Reach Victims?
The repositories contain a weaponised Terraform dependency lock file, named “.terraform.lock.hcl”, which points to malicious domains. This causes the platform to download attacker-controlled modules when the unsuspecting developer runs the “terraform init” command.
The attack chain ultimately leads to the deployment of two Rust-based malware families targeting ARM-based macOS systems, identified as FLATROOF and ROOFDECK.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Can FLATROOF and ROOFDECK Do?
FLATROOF is a backdoor that uses Telegram for command-and-control communication. It can execute commands, upload and download files, and steal data including iCloud Drive content, Brave and Firefox information, Safari browser data, Terminal command histories, installed application listings, system hardware and software profiles, snapshots of running processes and a copy of the login.keychain-db.
ROOFDECK uses the Nostr protocol for decentralised command-and-control communication. It supports system reconnaissance, file manipulation, remote shell access, lateral movement and persistence through Launch Agents.
ROOFDECK commands are signed with the operator’s private key and verified using an embedded public key before execution. Its functionality is divided into separate handlers in the source code.
The implant can also reimplement common shell commands involving directory and file operations, a tactic described as being used in more sophisticated North Korea-aligned toolsets.
What Happened at the Indian IT Provider?
The investigation into the two backdoors uncovered an additional, unrelated victim, an India-based IT services provider that was compromised through an Apple Silicon MacBook belonging to a DevOps engineer.
The backdoors were detected on the machine as early as March 18, 2026, although the exact delivery mechanism remains unknown.
The implants remained dormant until March 29, when beaconing and host activity began. They were first launched by Cursor seconds after the cloudshield workspace at ~/DevOps-Automation/cloudshield was opened.
How Did the Attack Develop After Compromise?
Evidence indicates that ROOFDECK is deployed as a follow-up tool on compromised hosts after attackers establish an initial foothold and control.
An updated version of ROOFDECK was reportedly deployed on the DevOps engineer’s system on April 20, 2026, one day after LayerZero publicly acknowledged the KelpDAO hack.
The newer variant removed existing ROOFDECK and FLATROOF binaries and stripped symbols and debug information in an apparent attempt to evade detection.
The campaign’s initial access activity focused on third parties and their software supply chains. Development endpoints can provide access to cloud environments, pipelines and source code, making them particularly sensitive systems within organisations.
Why Are Developer Systems a Key Risk?
The campaign shows how attackers can focus on individual engineers rather than attempting to breach an organisation directly. Purpose-built development environments, malicious repositories and backdoored Terraform builds can create a route from a developer endpoint into wider corporate infrastructure.
The activity also demonstrates how legitimate-looking job interviews and coding projects can be used as an entry point for malware deployment, particularly against developers working in cryptocurrency, financial technology and DevOps roles.
The420 Developer Security Takeaway
Developer laptops can provide access far beyond a single endpoint, including cloud systems, software pipelines and source code. This campaign shows why job-interview repositories and unfamiliar development projects should not be treated as trustworthy simply because they appear technically legitimate. The use of a weaponised Terraform dependency file also shows how routine developer commands can become part of an attack chain.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
