# Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors

> DPRK state-sponsored actor Jade Sleet (TraderTraitor/UNC4899/PUKCHONG/Slow Pisces) breached an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook using a fake job-interview lure and a weaponized Terraform dependency lock file. The intrusion deployed two Rust-based macOS/ARM64 backdoors - FLATROOF (Telegram C2, aka macOS.Gaslight) and ROOFDECK (Nostr-protocol dead-drop C2) - the same toolset used against a LayerZero Labs developer in the precursor $292M KelpDAO bridge theft, with an updated, symbol-stripped ROOFDECK variant staged one day after that theft's public disclosure.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2599
- **ID:** TL-2026-2599
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Jade Sleet (North Korea)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SentinelLabs ("Don't Call Us, We'll Call Your APIs") documented a second, non-cryptocurrency victim of the FLATROOF/ROOFDECK toolset first seen in the DPRK-attributed compromise of a LayerZero Labs developer that preceded the April 2026 KelpDAO rsETH bridge theft (~$292M, 116,500 rsETH). The new victim is a smaller India-based IT services provider, reached via a fake job-interview lure using GitHub repositories staged as infrastructure-engineering coding exercises (gtn-candidate-repo, terraform-candidate-repo, Northwind-IAC, novacart-interview and related forks). The lure's Terraform project ships a weaponized .terraform.lock.hcl referencing typosquatted provider registries (registry.hashicorp-aws[.]com and variants); running `terraform init` fetches and executes the malicious custom provider before any legitimate verification occurs.

Once foothold is established, FLATROOF (Rust, ARM64 macOS, deployed as ~/Library/com.apple.iTunesCloud/SystemUpdate) strips the com.apple.quarantine attribute and chmod +x's the secondary implant, then runs a bundled Python module to harvest Chrome/Brave/Firefox/Safari browser data, terminal history, installed applications, process snapshots, system_profiler output, and a raw copy of login.keychain-db, exfiltrating everything via a hardcoded Telegram bot. A related SentinelOne report tracks this family as macOS.Gaslight and documents a distinctive anti-analysis feature: a 3.5KB, 38-message fabricated "system failure" payload wrapped in {{DATA}} delimiters, designed to be ingested by LLM-assisted malware-triage tooling and induce it to abort analysis - an indirect prompt-injection attack aimed at AI-assisted defenders rather than sandboxes.

ROOFDECK (Rust, ARM64 macOS; initial path ~/Library/com.apple.internal.ck/iSync) is the more capable, persistent implant: full filesystem/process control, an interactive reverse shell, AES-encrypted archive staging, clipboard read/write (enabling cryptocurrency-address swapping and seed-phrase capture), and RSA-2048-signed command tasking. It resolves its live C2 endpoint dynamically by querying public Nostr relays (damus.io, nos.lol, nostr.mom, and others) for an operator profile keyed by a hardcoded public key, extracting the actual C2 URL from the profile's "website" field - a decentralized dead-drop mechanism that survives takedown of any single relay or domain. Persistence is installed via a dynamically named ~/Library/LaunchAgents/*.plist LaunchAgent with RunAtLoad=true, masquerading as a Chrome renderer process (--type=renderer).

On the Indian provider's host, both implants were present by 2026-03-18 but dormant until 2026-03-29, when Cursor IDE terminal sessions spawned both binaries; FLATROOF began Telegram beaconing and ROOFDECK connected to storage.hubpage[.]cloud. On 2026-04-13 the engineer cloned the weaponized terraform-candidate-repo via GitHub Desktop, and FLATROOF re-armed ROOFDECK the next day. One day after LayerZero's public disclosure of the KelpDAO theft (2026-04-20), the operators staged an updated, symbol-stripped ROOFDECK binary (loginwindow) from 85.137.56.10, brought it online to a new C2 (grenight[.]com), and deleted the original implants for anti-forensics. Beaconing to grenight[.]com continued through 2026-06-01. The engineer held AWS, OVH, and OpenStack credentials with source-control access, giving the actor a path to pivot into cloud/pipeline infrastructure had the intrusion continued.

The precursor incident - the KelpDAO/LayerZero attack - began 2026-03-06 when the actor socially engineered a LayerZero Labs developer to harvest session keys and pivot into LayerZero's RPC cloud environment, then patched running RPC node memory to return falsified responses to monitoring tools while DDoSing external RPC providers, forcing the DVN signing service onto two compromised internal nodes that forged cross-chain attestations. Because the affected application used a single-verifier (1-of-1) DVN configuration, the forged attestations were accepted without a second independent check, draining 116,500 rsETH (~$292M) on 2026-04-18. Mandiant, CrowdStrike, and independent researchers attributed the theft to TraderTraitor/UNC4899. Jade Sleet/TraderTraitor is also linked to the ~$1.4-1.5B Bybit cold-wallet theft (Safe{Wallet} supply-chain compromise, early 2025) and is assessed to operate under North Korea's Reconnaissance General Bureau, Third Bureau.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1543.001 Launch Agent
- T1078.004 Cloud Accounts
- T1553.001 Gatekeeper Bypass
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1580 Cloud Infrastructure Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- AML.T0051.001 Indirect

## Sources

- [Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors](https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html)
- [Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties](https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/)
- [macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox](https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/)
- [LayerZero Labs KelpDAO Incident Report](https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report)
- [Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains](https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains)
- [LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus](https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd292-million-exploit-attributes-it-to-north-korea-s-lazarus)
- [Inside the KelpDAO Bridge Exploit](https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/)
- [Rust macOS Backdoor Uses Interactive Shell and Telegram File Uploads for Data Theft](https://cybersecuritynews.com/rust-macos-backdoor-uses-interactive-shell/)
- [Explained: The Kelp DAO Hack (April 2026)](https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2599