Skip to navigation

Threat reportMalwareTL-2026-2599

Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors

highACTIVE

DPRK state-sponsored actor Jade Sleet (TraderTraitor/UNC4899/PUKCHONG/Slow Pisces) breached an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook using a fake job-interview lure and a weaponized Terraform dependency lock file.

Key facts for Jade Sleet Rust backdoors

IdentifiersTL-2026-2599
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsApple macOS on Apple Silicon (ARM64); HashiCorp Terraform (provider trust model / .terraform.lock.hcl)
Weaknesses (CWE)CWE-829
AttributionJade Sleet (high confidence)
Nation-state nexusNorth Korea
MalwareBONZAI, FLATROOF, ROOFDECK
ToolsCursor, Nostr relay network (decentralized dead-drop C2 resolution)
MITRE ATT&CK / ATLAS techniquesAML.T0051.001 Indirect, T1005 Data from Local System, T1027 Obfuscated Files or Information, T1070.004 File Deletion, T1071.001 Web Protocols, T1078.004 Cloud Accounts, T1082 System Information Discovery, T1195.002 Compromise Software Supply Chain, T1204.002 Malicious File, T1543.001 Launch Agent, T1553.001 Gatekeeper Bypass, T1555.001 Keychain and 5 more in the attack flow
MotivationFINANCIAL
Target sectorsinformation-technology-services, cryptocurrency, decentralized-finance, cloud-infrastructure
Target regionsindia, Global (cryptocurrency/DeFi sector)
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Jade Sleet Rust backdoors

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2599 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FLATROOF Telegram Bot API C2 Beaconing from Unsigned macOS Endpoint Binary

Detects outbound HTTPS traffic to the Telegram Bot API (api.telegram.org) originating from an unsigned binary in a masquerading ~/Library path (SystemUpdate), consistent with FLATROOF's hardcoded-bot-token exfiltration channel for harvested browser data, keychain copies, and system reconnaissance output.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071.001, T1005, T1560.001
  • Data sources: proxy_web_logs, dns_logs, edr_network_telemetry
  • Severity: critical
  • Confidence: high

Splunk SPL

index=network sourcetype="stream:http" OR sourcetype="proxy"
  dest="api.telegram.org" OR url="*api.telegram.org*"
| eval c2_time=_time, c2_host=src_ip
| join type=inner max=0 c2_host
    [ search index=endpoint sourcetype="osquery:results" process_path="*/Library/com.apple.iTunesCloud/SystemUpdate*"
      | rename host as c2_host, _time as proc_time
      | fields c2_host proc_time process_path ]
| eval delta=abs(c2_time-proc_time)
| where delta<=600
| table c2_time c2_host url dest process_path delta

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "api.telegram.org" or DestinationHostName == "api.telegram.org"
| project DeviceId, DeviceName, C2Time = Timestamp, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessFolderPath
| where InitiatingProcessFolderPath has "com.apple.iTunesCloud" or InitiatingProcessFileName == "SystemUpdate"
| order by C2Time desc

Sigma

title: FLATROOF Telegram Bot API C2 Beacon from Masquerading macOS Binary
id: 7e9f1a23-4d6c-4a8e-9f2b-5c7d9e1f3a4b
status: experimental
description: Detects network connections to the Telegram Bot API (api.telegram.org) initiated by a process running from a masquerading ~/Library path (com.apple.iTunesCloud/SystemUpdate) — the FLATROOF (macOS.Gaslight) hardcoded C2/exfiltration channel.
references:
    - https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.exfiltration
    - attack.t1041
    - attack.group.jade_sleet
    - attack.malware.flatroof
logsource:
    category: network_connection
    product: macos
detection:
    selection:
        DestinationHostname: 'api.telegram.org'
        Image|contains: 'com.apple.iTunesCloud'
    condition: selection
falsepositives:
    - Legitimate Telegram bot integrations built and run by developers/DevOps for internal tooling; verify the initiating binary's code signature and install path
level: critical

Known false positives:

  • Legitimate internal Telegram-bot-based alerting/ChatOps tooling; distinguish by verifying the initiating process is not the unsigned, masquerading SystemUpdate binary

Tuning notes: Alert on ANY api.telegram.org traffic from a process outside an organizationally-approved allowlist of ChatOps binaries, and raise to critical when the initiating binary path matches known FLATROOF masquerade paths (com.apple.iTunesCloud, com.apple.internal.ck, com.apple.appleaccountd).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • GitHub Desktop Clone of Fake Job-Interview Repository Followed by Terraform Execution · unlock with TL Creds
  • ROOFDECK LaunchAgent Persistence Masquerading as Chrome Renderer With Keychain/Browser Data Access · unlock with TL Creds
  • ROOFDECK Nostr Relay Dead-Drop C2 Resolution Followed by Connection to Resolved C2 Domain · unlock with TL Creds
  • DNS Query to Typosquatted HashiCorp Terraform Provider Registry · unlock with TL Creds
  • Anti-Forensic Implant Replacement — New Unsigned Binary Staged and Original Deleted Within Minutes · unlock with TL Creds
  • Network Connection to Known Jade Sleet FLATROOF/ROOFDECK C2 Infrastructure · unlock with TL Creds
  • Terraform Init Fetching Weaponized Provider from Typosquatted HashiCorp Registry (Jade Sleet Job-Interview Lure) · unlock with TL Creds
  • Quarantine Attribute Removal and chmod +x on Masquerading ~/Library Binary (FLATROOF/ROOFDECK Drop-and-Execute) · unlock with TL Creds

Indicators of compromise for Jade Sleet Rust backdoors

As of 2026-09-21, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-2599.

Sample indicators (3 of 28)

  • IP address: 176.97.114[.]232
  • Domain: registry[.]hashicorp-aws[.]com
  • File hash: 02df07a173ab03b82a4fb6a08973fff8b1467f28

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

28 indicators of compromise · unlock with TL Creds. Compare plans

How Jade Sleet Rust backdoors works

The intrusion deployed two Rust-based macOS/ARM64 backdoors - FLATROOF (Telegram C2, aka macOS.Gaslight) and ROOFDECK (Nostr-protocol dead-drop C2) - the same toolset used against a LayerZero Labs developer in the precursor $292M KelpDAO bridge theft, with an updated, symbol-stripped ROOFDECK variant staged one day after that theft's public disclosure.

SentinelLabs ("Don't Call Us, We'll Call Your APIs") documented a second, non-cryptocurrency victim of the FLATROOF/ROOFDECK toolset first seen in the DPRK-attributed compromise of a LayerZero Labs developer that preceded the April 2026 KelpDAO rsETH bridge theft (~$292M, 116,500 rsETH). The new victim is a smaller India-based IT services provider, reached via a fake job-interview lure using GitHub repositories staged as infrastructure-engineering coding exercises (gtn-candidate-repo, terraform-candidate-repo, Northwind-IAC, novacart-interview and related forks). The lure's Terraform project ships a weaponized .terraform.lock.hcl referencing typosquatted provider registries (registry.hashicorp-aws[.]com and variants); running `terraform init` fetches and executes the malicious custom provider before any legitimate verification occurs.

Once foothold is established, FLATROOF (Rust, ARM64 macOS, deployed as ~/Library/com.apple.iTunesCloud/SystemUpdate) strips the com.apple.quarantine attribute and chmod +x's the secondary implant, then runs a bundled Python module to harvest Chrome/Brave/Firefox/Safari browser data, terminal history, installed applications, process snapshots, system_profiler output, and a raw copy of login.keychain-db, exfiltrating everything via a hardcoded Telegram bot. A related SentinelOne report tracks this family as macOS.Gaslight and documents a distinctive anti-analysis feature: a 3.5KB, 38-message fabricated "system failure" payload wrapped in {{DATA}} delimiters, designed to be ingested by LLM-assisted malware-triage tooling and induce it to abort analysis - an indirect prompt-injection attack aimed at AI-assisted defenders rather than sandboxes.

ROOFDECK (Rust, ARM64 macOS; initial path ~/Library/com.apple.internal.ck/iSync) is the more capable, persistent implant: full filesystem/process control, an interactive reverse shell, AES-encrypted archive staging, clipboard read/write (enabling cryptocurrency-address swapping and seed-phrase capture), and RSA-2048-signed command tasking. It resolves its live C2 endpoint dynamically by querying public Nostr relays (damus.io, nos.lol, nostr.mom, and others) for an operator profile keyed by a hardcoded public key, extracting the actual C2 URL from the profile's "website" field - a decentralized dead-drop mechanism that survives takedown of any single relay or domain. Persistence is installed via a dynamically named ~/Library/LaunchAgents/*.plist LaunchAgent with RunAtLoad=true, masquerading as a Chrome renderer process (--type=renderer).

On the Indian provider's host, both implants were present by 2026-03-18 but dormant until 2026-03-29, when Cursor IDE terminal sessions spawned both binaries; FLATROOF began Telegram beaconing and ROOFDECK connected to storage.hubpage[.]cloud. On 2026-04-13 the engineer cloned the weaponized terraform-candidate-repo via GitHub Desktop, and FLATROOF re-armed ROOFDECK the next day. One day after LayerZero's public disclosure of the KelpDAO theft (2026-04-20), the operators staged an updated, symbol-stripped ROOFDECK binary (loginwindow) from 85.137.56.10, brought it online to a new C2 (grenight[.]com), and deleted the original implants for anti-forensics. Beaconing to grenight[.]com continued through 2026-06-01. The engineer held AWS, OVH, and OpenStack credentials with source-control access, giving the actor a path to pivot into cloud/pipeline infrastructure had the intrusion continued.

The precursor incident - the KelpDAO/LayerZero attack - began 2026-03-06 when the actor socially engineered a LayerZero Labs developer to harvest session keys and pivot into LayerZero's RPC cloud environment, then patched running RPC node memory to return falsified responses to monitoring tools while DDoSing external RPC providers, forcing the DVN signing service onto two compromised internal nodes that forged cross-chain attestations. Because the affected application used a single-verifier (1-of-1) DVN configuration, the forged attestations were accepted without a second independent check, draining 116,500 rsETH (~$292M) on 2026-04-18. Mandiant, CrowdStrike, and independent researchers attributed the theft to TraderTraitor/UNC4899. Jade Sleet/TraderTraitor is also linked to the ~$1.4-1.5B Bybit cold-wallet theft (Safe{Wallet} supply-chain compromise, early 2025) and is assessed to operate under North Korea's Reconnaissance General Bureau, Third Bureau.

MITRE ATT&CK / ATLAS techniques by tactic:

execution

AML.T0051.001 Indirect

Collection

T1005 Data from Local System; T1560.001 Archive via Utility

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion

Command and Control

T1071.001 Web Protocols; T1573.002 Asymmetric Cryptography

Privilege Escalation

T1078.004 Cloud Accounts

Discovery

T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link

Execution

T1204.002 Malicious File

Persistence

T1543.001 Launch Agent

defense-impairment

T1553.001 Gatekeeper Bypass

Credential Access

T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Remediation for Jade Sleet Rust backdoors

Immediate actions

  • Flag engineers with cloud engineering permissions and source-control access as a sensitive monitoring group for endpoint security
  • Hunt for unsigned binaries executing from ~/Library/ paths, especially those masquerading as system daemons (SystemUpdate, iSync, loginwindow)
  • Alert on rapid xattr (quarantine removal) + chmod +x sequences on user-writable binaries
  • Rotate and audit AWS/GCP/cloud API keys and source-control credentials for any DevOps endpoint that ran an untrusted Terraform project

Workarounds

  • Add Terraform provider-domain verification to security awareness training; verify .terraform.lock.hcl provider registries resolve to the official registry.terraform.io namespace before running terraform init
  • Manually inspect third-party Terraform provider source before inclusion in any candidate-assessment or onboarding repository

Longer-term hardening

  • Implement policy restricting corporate/BYOD workstations with cloud or source-control access from participating in external job-interview coding exercises
  • Monitor IDE (Cursor, VS Code) child-process trees for shell sessions that spawn non-IDE binaries from home-directory paths
  • Deploy detection for outbound connections to Nostr relay WebSocket endpoints and Telegram Bot API traffic from developer endpoints
  • Require independent multi-verifier (not single-DVN) configurations for cross-chain bridge message validation

Affected and fixed versions

  • Apple — macOS on Apple Silicon (ARM64)
    Vulnerable versions: Any macOS/ARM64 endpoint executing the weaponized Terraform lure and lacking EDR coverage for unsigned ~/Library binaries
  • HashiCorp — Terraform (provider trust model / .terraform.lock.hcl)
    Vulnerable versions: Any Terraform version that executes custom provider blocks referenced in a lock file without registry-namespace verification

Timeline of Jade Sleet Rust backdoors

  • The Jade Sleet/TraderTraitor/UNC4899 cluster is previously tied to the ~$1.4-1.5B Bybit cold-wallet theft via a Safe{Wallet} supply-chain compromise, establishing the actor's crypto-theft track record.
  • Attacker socially engineers a LayerZero Labs developer to harvest session keys, pivoting into LayerZero's RPC cloud environment ahead of the KelpDAO bridge attack.
  • locked-ioc-25 and locked-ioc-26 binaries first present on the India-based IT provider's DevOps engineer MacBook; initial delivery vector for this host not directly observed in telemetry.
  • locked-ioc-28 IDE terminal sessions spawn both implants (SystemUpdate/locked-ioc-25, iSync/locked-ioc-26); locked-ioc-25 connects to Telegram C2 and locked-ioc-26 beacons to locked-ioc-16 (locked-ioc-22).
  • DevOps engineer clones the weaponized terraform-candidate-repo via GitHub Desktop as part of the fake job-interview lure.
  • locked-ioc-25 re-arms locked-ioc-26, stripping the com.apple.quarantine attribute and re-running chmod +x on the implant.
  • KelpDAO's rsETH bridge on LayerZero is drained of 116,500 rsETH (~$292M) via compromised DVN/RPC nodes and forged cross-chain attestations under a single-verifier (1-of-1) configuration.
  • LayerZero publicly discloses the KelpDAO incident.
  • Updated, symbol-stripped locked-ioc-26 binary (loginwindow) staged from locked-ioc-24 and brought online to new C2 locked-ioc-23 (locked-ioc-20) one day after the LayerZero disclosure; original implants deleted (rm -f) for anti-forensics.
  • A locked-ioc-25 sample (tracked separately as macOS.Gaslight) is uploaded to VirusTotal, later flagged by an Apple XProtect signature update (MACOS_BONZAI_COBUCH).
  • Final observed C2 beacon from the stage-3 loginwindow implant to locked-ioc-23 in the Indian IT provider's telemetry.
  • loginwindow binary moved to Trash on the compromised host, ending observed activity.
  • SentinelOne discloses macOS.Gaslight's embedded 38-message prompt-injection payload designed to derail LLM-assisted malware triage.
  • SentinelOne Labs publishes "Don't Call Us, We'll Call Your APIs," formally linking the Indian IT provider intrusion to the LayerZero/KelpDAO locked-ioc-25/locked-ioc-26 campaign.
  • The Hacker News reports on the SentinelOne findings, surfacing the threat for tracking.

Sources cited for Jade Sleet Rust backdoors

More from Jade Sleet

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats