Cybersecurity
Jade Sleet linked to Indian IT breach with macOS backdoors
SentinelOne said it found FLATROOF and ROOFDECK on an Apple Silicon MacBook used by a DevOps engineer at an India-based IT services provider, and linked the activity to Jade Sleet.
- SentinelOne said Jade Sleet compromised an India-based IT services provider.
- The company said the campaign used the FLATROOF and ROOFDECK backdoors, which had also been seen in the March-April 2026 attack on KelpDAO's LayerZero bridge.
- SentinelOne said the victim device was an Apple Silicon MacBook used by a DevOps engineer, and that the backdoors were found on it from 18 March 2026.
- The researchers said the implants became active on 29 March after Cursor opened the cloudshield workspace, and that an updated ROOFDECK variant was deployed on 20 April 2026.
SentinelOne said the campaign used recruitment-themed GitHub repositories to draw in developers. It said the repositories carried a modified Terraform lock file that pointed to attacker-run domains and fetched modules when terraform init was run.
The company said the attack installed two Rust backdoors on ARM-based macOS systems. FLATROOF used Telegram for command traffic and could run commands, move files and collect browser and system data, while ROOFDECK used Nostr and could inspect systems, alter files, open a remote shell, move laterally and persist through Launch Agents.
SentinelOne said its investigation also found an unrelated victim, an India-based IT services provider. The device was an Apple Silicon MacBook used by a DevOps engineer, and the implants were already present by 18 March 2026.
The researchers said the implants stayed dormant until 29 March, then began beaconing after Cursor opened the cloudshield workspace. They said an updated ROOFDECK build was deployed on 20 April 2026, one day after LayerZero acknowledged the KelpDAO incident.
Named in this story
People
- Albert Priego
- was one of the researchers quoted
- Alex Delamotte
- was one of the researchers quoted
- Matej Havranek
- was one of the researchers quoted
Companies
- SentinelOne
- disclosed the findings and attributed the activity
- LayerZero
- had a bridge attack referenced in the report
- Bybit
- was said to have lost about $1.5 billion in an earlier theft
- GitHub
- was cited for a 2023 note on Jade Sleet targets
Organisations
- Jade Sleet
- was the North Korean threat actor attributed to the compromise
- KelpDAO
- was the victim named in the earlier March-April 2026 attack
Products and systems
- FLATROOF
- was one of the macOS backdoors used in the campaign
- ROOFDECK
- was the other macOS backdoor used in the campaign
- Safe{Wallet}
- had its developer environment cited in the earlier compromise
- Cursor
- was the app that launched the implants on 29 March
- Apple Silicon MacBook
- was the compromised device used by a DevOps engineer
Places
- India
- was where the victim IT services provider was based
How the source tells it
The source was a technical incident report with little overt emotive framing.
No emotive framing was found in the original.