Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors

Jade Sleet (North Korea) Compromises Indian IT Provider via (TL-2026-2599) is a high-severity malware campaign, first published 2026-09-21. It is attributed to Jade Sleet (North Korea) with high confidence, affects Apple macOS on Apple Silicon (ARM64), maps to 17 MITRE ATT&CK / ATLAS techniques (AML.T0051.001, T1005, T1027), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-2599

Threat ID
TL-2026-2599
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-21
Last reviewed
2026-09-21
Attribution
Jade Sleet
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
information-technology-services, cryptocurrency, decentralized-finance, cloud-infrastructure
Target regions
india, Global (cryptocurrency/DeFi sector)
Detection rules
9
Indicators of compromise
28

Malware and tooling in Jade Sleet (North Korea) Compromises Indian IT Provider via

Malware and tooling: BONZAI, FLATROOF, ROOFDECK, Cursor, Nostr relay network (decentralized dead-drop C2 resolution)

DPRK state-sponsored actor Jade Sleet (TraderTraitor/UNC4899/PUKCHONG/Slow Pisces) breached an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook using a fake job-interview lure and a weaponized Terraform dependency lock file. The intrusion deployed two Rust-based macOS/ARM64 backdoors - FLATROOF (Telegram C2, aka macOS.Gaslight) and ROOFDECK (Nostr-protocol dead-drop C2) - the same toolset used against a LayerZero Labs developer in the precursor $292M KelpDAO bridge theft, with an updated, symbol-stripped ROOFDECK variant staged one day after that theft's public disclosure.

How Jade Sleet (North Korea) Compromises Indian IT Provider via works

SentinelLabs ("Don't Call Us, We'll Call Your APIs") documented a second, non-cryptocurrency victim of the FLATROOF/ROOFDECK toolset first seen in the DPRK-attributed compromise of a LayerZero Labs developer that preceded the April 2026 KelpDAO rsETH bridge theft (~$292M, 116,500 rsETH). The new victim is a smaller India-based IT services provider, reached via a fake job-interview lure using GitHub repositories staged as infrastructure-engineering coding exercises (gtn-candidate-repo, terraform-candidate-repo, Northwind-IAC, novacart-interview and related forks). The lure's Terraform project ships a weaponized .terraform.lock.hcl referencing typosquatted provider registries (registry.hashicorp-aws[.]com and variants); running `terraform init` fetches and executes the malicious custom provider before any legitimate verification occurs.

Once foothold is established, FLATROOF (Rust, ARM64 macOS, deployed as ~/Library/com.apple.iTunesCloud/SystemUpdate) strips the com.apple.quarantine attribute and chmod +x's the secondary implant, then runs a bundled Python module to harvest Chrome/Brave/Firefox/Safari browser data, terminal history, installed applications, process snapshots, system_profiler output, and a raw copy of login.keychain-db, exfiltrating everything via a hardcoded Telegram bot. A related SentinelOne report tracks this family as macOS.Gaslight and documents a distinctive anti-analysis feature: a 3.5KB, 38-message fabricated "system failure" payload wrapped in {{DATA}} delimiters, designed to be ingested by LLM-assisted malware-triage tooling and induce it to abort analysis - an indirect prompt-injection attack aimed at AI-assisted defenders rather than sandboxes.

ROOFDECK (Rust, ARM64 macOS; initial path ~/Library/com.apple.internal.ck/iSync) is the more capable, persistent implant: full filesystem/process control, an interactive reverse shell, AES-encrypted archive staging, clipboard read/write (enabling cryptocurrency-address swapping and seed-phrase capture), and RSA-2048-signed command tasking. It resolves its live C2 endpoint dynamically by querying public Nostr relays (damus.io, nos.lol, nostr.mom, and others) for an operator profile keyed by a hardcoded public key, extracting the actual C2 URL from the profile's "website" field - a decentralized dead-drop mechanism that survives takedown of any single relay or domain. Persistence is installed via a dynamically named ~/Library/LaunchAgents/*.plist LaunchAgent with RunAtLoad=true, masquerading as a Chrome renderer process (--type=renderer).

On the Indian provider's host, both implants were present by 2026-03-18 but dormant until 2026-03-29, when Cursor IDE terminal sessions spawned both binaries; FLATROOF began Telegram beaconing and ROOFDECK connected to storage.hubpage[.]cloud. On 2026-04-13 the engineer cloned the weaponized terraform-candidate-repo via GitHub Desktop, and FLATROOF re-armed ROOFDECK the next day. One day after LayerZero's public disclosure of the KelpDAO theft (2026-04-20), the operators staged an updated, symbol-stripped ROOFDECK binary (loginwindow) from 85.137.56.10, brought it online to a new C2 (grenight[.]com), and deleted the original implants for anti-forensics. Beaconing to grenight[.]com continued through 2026-06-01. The engineer held AWS, OVH, and OpenStack credentials with source-control access, giving the actor a path to pivot into cloud/pipeline infrastructure had the intrusion continued.

The precursor incident - the KelpDAO/LayerZero attack - began 2026-03-06 when the actor socially engineered a LayerZero Labs developer to harvest session keys and pivot into LayerZero's RPC cloud environment, then patched running RPC node memory to return falsified responses to monitoring tools while DDoSing external RPC providers, forcing the DVN signing service onto two compromised internal nodes that forged cross-chain attestations. Because the affected application used a single-verifier (1-of-1) DVN configuration, the forged attestations were accepted without a second independent check, draining 116,500 rsETH (~$292M) on 2026-04-18. Mandiant, CrowdStrike, and independent researchers attributed the theft to TraderTraitor/UNC4899. Jade Sleet/TraderTraitor is also linked to the ~$1.4-1.5B Bybit cold-wallet theft (Safe{Wallet} supply-chain compromise, early 2025) and is assessed to operate under North Korea's Reconnaissance General Bureau, Third Bureau.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2599

execution

AML.T0051.001 Indirect

Collection

T1005 Data from Local System; T1560.001 Archive via Utility

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion

Command and Control

T1071.001 Web Protocols; T1573.002 Asymmetric Cryptography

Privilege Escalation

T1078.004 Cloud Accounts

Discovery

T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link

Execution

T1204.002 Malicious File

Persistence

T1543.001 Launch Agent

defense-impairment

T1553.001 Gatekeeper Bypass

Credential Access

T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Affected products and versions in Jade Sleet (North Korea) Compromises Indian IT Provider via

  • Apple — macOS on Apple Silicon (ARM64)
    Vulnerable versions: Any macOS/ARM64 endpoint executing the weaponized Terraform lure and lacking EDR coverage for unsigned ~/Library binaries
  • HashiCorp — Terraform (provider trust model / .terraform.lock.hcl)
    Vulnerable versions: Any Terraform version that executes custom provider blocks referenced in a lock file without registry-namespace verification

Remediation for Jade Sleet (North Korea) Compromises Indian IT Provider via

Immediate actions

  • Flag engineers with cloud engineering permissions and source-control access as a sensitive monitoring group for endpoint security
  • Hunt for unsigned binaries executing from ~/Library/ paths, especially those masquerading as system daemons (SystemUpdate, iSync, loginwindow)
  • Alert on rapid xattr (quarantine removal) + chmod +x sequences on user-writable binaries
  • Rotate and audit AWS/GCP/cloud API keys and source-control credentials for any DevOps endpoint that ran an untrusted Terraform project

Workarounds

  • Add Terraform provider-domain verification to security awareness training; verify .terraform.lock.hcl provider registries resolve to the official registry.terraform.io namespace before running terraform init
  • Manually inspect third-party Terraform provider source before inclusion in any candidate-assessment or onboarding repository

Longer-term hardening

  • Implement policy restricting corporate/BYOD workstations with cloud or source-control access from participating in external job-interview coding exercises
  • Monitor IDE (Cursor, VS Code) child-process trees for shell sessions that spawn non-IDE binaries from home-directory paths
  • Deploy detection for outbound connections to Nostr relay WebSocket endpoints and Telegram Bot API traffic from developer endpoints
  • Require independent multi-verifier (not single-DVN) configurations for cross-chain bridge message validation

Weaknesses (CWE) in Jade Sleet (North Korea) Compromises Indian IT Provider via

CWE-829

Timeline of Jade Sleet (North Korea) Compromises Indian IT Provider via

  • The Jade Sleet/TraderTraitor/UNC4899 cluster is previously tied to the ~$1.4-1.5B Bybit cold-wallet theft via a Safe{Wallet} supply-chain compromise, establishing the actor's crypto-theft track record.
  • Attacker socially engineers a LayerZero Labs developer to harvest session keys, pivoting into LayerZero's RPC cloud environment ahead of the KelpDAO bridge attack.
  • FLATROOF and ROOFDECK binaries first present on the India-based IT provider's DevOps engineer MacBook; initial delivery vector for this host not directly observed in telemetry.
  • Cursor IDE terminal sessions spawn both implants (SystemUpdate/FLATROOF, iSync/ROOFDECK); FLATROOF connects to Telegram C2 and ROOFDECK beacons to storage.hubpage[.]cloud (45.11.59.140).
  • DevOps engineer clones the weaponized terraform-candidate-repo via GitHub Desktop as part of the fake job-interview lure.
  • FLATROOF re-arms ROOFDECK, stripping the com.apple.quarantine attribute and re-running chmod +x on the implant.
  • KelpDAO's rsETH bridge on LayerZero is drained of 116,500 rsETH (~$292M) via compromised DVN/RPC nodes and forged cross-chain attestations under a single-verifier (1-of-1) configuration.
  • LayerZero publicly discloses the KelpDAO incident.
  • Updated, symbol-stripped ROOFDECK binary (loginwindow) staged from 85.137.56.10 and brought online to new C2 grenight[.]com (85.137.56.245) one day after the LayerZero disclosure; original implants deleted (rm -f) for anti-forensics.
  • A FLATROOF sample (tracked separately as macOS.Gaslight) is uploaded to VirusTotal, later flagged by an Apple XProtect signature update (MACOS_BONZAI_COBUCH).
  • Final observed C2 beacon from the stage-3 loginwindow implant to grenight[.]com in the Indian IT provider's telemetry.
  • loginwindow binary moved to Trash on the compromised host, ending observed activity.
  • SentinelOne discloses macOS.Gaslight's embedded 38-message prompt-injection payload designed to derail LLM-assisted malware triage.
  • SentinelOne Labs publishes "Don't Call Us, We'll Call Your APIs," formally linking the Indian IT provider intrusion to the LayerZero/KelpDAO FLATROOF/ROOFDECK campaign.
  • The Hacker News reports on the SentinelOne findings, surfacing the threat for tracking.

Sources cited for Jade Sleet (North Korea) Compromises Indian IT Provider via

More in malware

Detection coverage for TL-2026-2599

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2599 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats