Jade Sleet Breaks Out of Crypto Tunnel: macOS Backdoors Found in…

SentinelOne reveals North Korean threat actor Jade Sleet compromised an Indian IT services provider using the FLATROOF and ROOFDECK macOS backdoors, previously seen in the March–April 2026 LayerZero/KelpDAO bridge attack. The victim, a "much smaller organization" with no blockchain ties, signals an expansion beyond cryptocurrency targets.

North Korean threat actor Jade Sleet compromised an Indian IT services provider using the FLATROOF and ROOFDECK macOS backdoors, the same tools observed in the March–April 2026 LayerZero/KelpDAO bridge attack. The disclosure, published September 20, 2026 by SentinelOne and SentinelLabs, shows these implants are no longer confined to the cryptocurrency sector: the Indian victim, described as a "much smaller organization," has no links to blockchain. The compromised endpoint was an Apple Silicon MacBook belonging to a DevOps engineer with access to cloud credentials and source control.

Key Takeaways

The FLATROOF and ROOFDECK backdoors, both written in Rust for macOS ARM64, were previously observed in the March–April 2026 LayerZero/KelpDAO attack
The Indian victim is an IT provider with no crypto ties, indicating Jade Sleet's targeting has expanded beyond the blockchain sector
The implants resided on disk from March 18, 2026, remaining dormant until March 29, when opening a Cursor workspace triggered execution
The C2 leverages Telegram (FLATROOF) and the decentralized Nostr protocol (ROOFDECK), with dynamic implant updates for evasion

The Attack Chain: From Fake Interview to Persistent Backdoor

The delivery mechanism in the Indian victim remains unconfirmed. Sources indicate the campaign documented by SentinelLabs uses fake developer job interviews, with GitHub repositories containing a weaponized .terraform.lock.hcl file. This file points to typosquatted domains mimicking HashiCorp: registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, and registry.hashicorp-terraform[.]io, according to SentinelLabs via Technobezz.

Executing terraform init activates the malicious provider, which deploys the implants on the target system. In the Indian provider's case, the backdoors were present on disk as early as March 18, 2026. They lay dormant for eleven days until March 29, when opening the ~/DevOps-Automation/cloudshield workspace in Cursor triggered execution of both implants within seconds.

FLATROOF was placed as SystemUpdate in the ~/Library/com.apple.iTunesCloud/ directory, according to SentinelLabs. This component removes the quarantine attribute and sets the executable bit on ROOFDECK, which runs without signature verification. On April 14, 2026 at 18:25, FLATROOF re-armed ROOFDECK, confirming active system persistence.

Two Backdoors, Two C2 Protocols: Telegram and Nostr

The functional division between the two implants is clear. FLATROOF handles data collection and command-and-control via Telegram. ROOFDECK provides remote shell, lateral movement, and advanced persistence, using the Nostr protocol for decentralized C2 infrastructure. This protocol, originally designed for censorship-resistant social networks, makes infrastructure takedown operationally more complex than with traditional centralized servers.

ROOFDECK verifies the integrity of received commands via an embedded public key before execution, a mechanism that reduces the risk of infrastructure hijacking by other actors. On April 20, 2026 — the day after LayerZero publicly acknowledged the KelpDAO hack — an updated version of ROOFDECK was deployed that strips symbols and debug information for evasion.

That same version removed the original implants at 13:15 and continued beaconing to grenight[.]com until June 1, 2026, according to SentinelLabs. Other identified domains and IPs include technicais at 176[.]97.114.232, hubpage at 45[.]11.59.140, and the staging address 85[.]137.56.10.

"These groups' initial access efforts include targeting third parties and their software supply chain, which is where much of the industry's exposure has moved, putting the developer endpoint at the center of the defense" — SentinelOne

Why a DevOps MacBook Became the Critical Perimeter

The choice of a development endpoint as entry point is not accidental. DevOps engineers operate with elevated privileges across cloud infrastructure, CI/CD pipelines, and source code repositories. A compromise of this role exposes not only personal credentials but potentially the entire client ecosystem of the IT provider. Indian outsourcing firms, which serve global corporations, represent a bridge to broader supply chains in this scenario.

Traditional perimeter-based defenses fail here because the attack traverses legitimate toolchains: Cursor, Terraform, GitHub Desktop. The terraform-candidate-repo repository was cloned via GitHub Desktop on April 13, 2026, an operation indistinguishable from a developer's normal workflow. Conditional beaconing triggered only by IDE usage — activated solely upon workspace opening — further reduces the detection surface for generic monitoring tools.

SentinelLabs explicitly notes that "the finding suggests the tools are not limited to crypto targets." This expansion aligns with a broader pattern: as early as July 2023, GitHub — then owned by Microsoft — observed that Jade Sleet "mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms." The Indian IT provider may represent a variation on this theme, or an evolution toward sector-agnostic targeting.

Immediate Actions

Sources indicate priority actions for organizations with developers using macOS and cloud infrastructure:

Check for connections to domains registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, registry.hashicorp-terraform[.]io, and grenight[.]com, as well as IPs 176[.]97.114.232, 45[.]11.59.140, and 85[.]137.56.10 in network logs
Inspect the ~/Library/com.apple.iTunesCloud/ directory on macOS systems for suspicious files named SystemUpdate or unsigned binaries
Monitor for terraform processes contacting unofficial HashiCorp registries, particularly when triggered from unverified GitHub repositories
Apply the same monitoring rigor to developer devices as to production servers, given the centrality of the "developer endpoint" in the defense perimeter

Unanswered Questions and the Limits of the Dossier

Several elements remain unconfirmed. The initial delivery mechanism in the Indian victim is "unknown at this stage" according to SentinelOne; the documented fake interviews may be part of a parallel campaign. It is unclear whether the "Northwind" and "Novacart" companies cited in the repositories are real or fabricated for social engineering. The ultimate objective of the attack — cloud credential theft, client access, or other — is not stated by sources.

No infrastructure overlap linking the Indian IT provider to LayerZero or KelpDAO has emerged to date. The hypothesis of a supply chain attack targeting the crypto sector remains unverified. Likewise, it is not reported whether other victims exist beyond the two known.

The ROOFDECK update on April 20, 2026, the day after LayerZero's public admission, suggests the actor's reactivity to counter-information: the removal of original implants and switch to a stripped-down version indicates operational awareness of exposure risk. This pattern — instrumental adaptation in response to public disclosure — is typical of nation-state actors with resources for continuous arsenal maintenance.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter