Jade Sleet plants FLATROOF and ROOFDECK backdoors on an Indian IT provider via fake job interviews
SentinelOne ties North Korea’s Jade Sleet to the compromise of an Indian IT services firm, reached through fake job interviews and poisoned Terraform modules. Treat developer endpoints as high-value targets and audit your Terraform dependency locks.
September 21, 2026. SentinelOne publishes research linking Jade Sleet, a North Korea-aligned actor, to the compromise of an IT services provider in India. March 18, 2026. Both backdoors are already sitting on a DevOps engineer’s MacBook, unnoticed. March 29. They wake up, seconds after a workspace opens inside the Cursor editor. Why it matters: the group that stole $1.5 billion from Bybit in early 2025 is no longer just chasing crypto — it is now hunting the companies that serve other companies.
A North Korean actor that targets developers
Jade Sleet is one of several aliases for a single actor, also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. Its historical specialty is cryptocurrency theft. In early 2025, it was tied to the theft of roughly $1.5 billion from Bybit’s cold wallet, following a supply-chain compromise of SafeWallet’s development environment. As far back as July 2023, GitHub described the target plainly: “Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms.”
What is new is where the targeting lands. The Indian provider that was compromised is, in SentinelOne’s words, a “much smaller organization” in the IT services industry. It is not a crypto exchange and not a Web3 protocol; it is a subcontractor whose business is to ship code, infrastructure, and access to other companies. By breaching it, Jade Sleet gains a path into the provider’s customers, not just into the provider itself.
The delivery relies on a simple human lever: the fake job interview. Victims are approached through fabricated job offers aimed at people in DevOps, cryptocurrency, or fintech roles. The interview becomes the pretext for cloning a “coding exercise” GitHub repository that is, in reality, booby-trapped.
Two Rust backdoors built for macOS
The payloads are two malware families written in Rust and aimed at ARM-based Macs (Apple Silicon). Both were previously observed in the March–April 2026 attack on KelpDAO’s LayerZero bridge.
FLATROOF, also known as Gaslight, is a backdoor that uses Telegram for command-and-control. It can execute commands, upload and download files, and steal data through a Python module: browsing history from Chrome, Brave, Firefox, and Safari, terminal command histories, installed applications, the machine’s hardware and software profile, a snapshot of running processes, and a copy of login.keychain-db.
ROOFDECK is more ambitious. It uses the Nostr protocol for decentralized C2 and can perform system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents. One notable detail: its commands are signed with the operator’s private key and verified against an embedded public key before execution. The code also re-implements many common shell commands, a tactic seen in more sophisticated North Korea-aligned toolsets such as Lazarus’s LightlessCan.
The choice of Rust and ARM macOS is itself a signal. These implants are compiled for Apple Silicon, the hardware developers increasingly use, and the language gives the authors both memory safety and binaries that are harder to reverse-engineer than the older C-based malware from the same actors. The two families are not off-the-shelf tooling; they are purpose-built and continuously recompiled, which is why one was updated and redeployed within weeks.
That signature has a defensive consequence: neither implant looks like generic malware. They blend into a developer’s normal tooling, masquerade as legitimate processes, and slip past detections built around classic shell signatures.
Poisoned GitHub repositories and a weaponized Terraform lock file
The initial access chain stacks two traps. The first is an innocuous-looking GitHub repository framed as an interview exercise. SentinelOne lists several observed repositories: gtn-candidate-repo (already used in the KelpDAO incident), Northwind-IAC, novacart-interview, and terraform-candidate-repo.
The second trap is subtler, because it fires without any obviously malicious code. These repositories ship a Terraform dependency lock file — a .terraform.lock.hcl — that points at attacker-controlled domains such as registry.hashicorp-aws[.]com. When the developer runs terraform init, the platform downloads attacker-controlled modules. The dependency lock, meant to pin safe versions, becomes the infection vector.
The elegance is in the discretion: no malicious binary in the repository, no obvious script. It is the legitimate infrastructure tooling — the package manager of infrastructure-as-code — that fetches the hostile code from the attacker. A quick review of the repository sees nothing wrong, because there is nothing wrong to see in the source code itself.
An Indian provider, a collateral victim
While hunting for the two backdoors, SentinelOne uncovered an additional victim with no crypto ties: an IT services provider based in India. The compromise came through a DevOps engineer’s Apple Silicon MacBook. The backdoors were present as early as March 18, 2026, though the exact delivery mechanism remains unknown at this stage.
They stayed dormant until March 29, when network activity began. The most striking detail: the implants were launched by Cursor, the code editor, seconds after the cloudshield workspace (~/DevOps-Automation/cloudshield) was opened. The very tool the developer works in daily served as the launcher.
ROOFDECK is deployed as a follow-on tool once initial access is established. An updated version was installed on April 20, 2026, the day after LayerZero publicly acknowledged the KelpDAO hack. That variant removes the old ROOFDECK and FLATROOF binaries and strips symbols and debug information to evade detection. The group cleans up after itself and keeps improving its implants.
The developer endpoint is now the perimeter
SentinelOne condenses the risk shift into a sentence: these groups’ initial access now runs through “third parties and their software supply chain, which puts the developer endpoint at the center of the defense.” A development machine carries access to the cloud, CI/CD pipelines, and source code. Breaching it opens more doors than breaching a desktop.
For a security leader, several signals should trigger an alert. First, hunting fake interviews: legitimate recruiters do not send a repository to clone before a verified conversation. Second, dependency monitoring: a .terraform.lock.hcl file pointing at a non-official domain — never hashicorp-aws.com — is a red flag, not a detail. Third, detection on developer endpoints: a code editor launching unexpected processes, new Launch Agents on a Mac, or traffic to Telegram or Nostr relays from an engineer’s machine are signals to correlate.
The response cannot be purely preventive. These campaigns use purpose-built development environments, one engineer at a time, with Terraform builds that differ for each victim. A static rule will not be enough; every developer endpoint must be treated as a high-privilege asset, segmented and monitored accordingly.
Verdict
If you employ developers — and even more so if you are an IT services provider — assume your company is an intermediate target, not only a final victim. Verify recruiter identities, block the cloning of unsolicited repositories on workstations, and systematically audit .terraform.lock.hcl files for suspicious domains. If you run macOS in the enterprise, add monitoring for Launch Agents, processes launched by your code editors, and outbound connections to Telegram and Nostr — that is where these implants give themselves away. If you maintain development environments, treat them as prime targets and segment their access: a compromised engineer’s machine must never reach production without a separate approval step.