North Korean actors use AI to scale social engineering and malware
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
74
Threat actor
Jade Sleet
- Mentions · 7d1
- Mentions · 30d3
- All mentions8
- First seenSep 7, 2026
- Last mentioned1d ago
Timeline
8 articles · newest firstHackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A trojanized Terraform AWS provider installs FLATROOF and ROOFDECK malware on developer macOS, Linux, and Windows systems.
76
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.
76
North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
78
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
80
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
76
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
68
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.
75
Appears with
- FLATROOFmalware · 6
- ROOFDECKmalware · 6
- Terraformproduct · 6
- TraderTraitorthreat actor · 5
- HashiCorpvendor · 5
- UNC4899threat actor · 4
- LayerZerovictim · 3
- Lazarus Groupthreat actor · 3
- KelpDAOvictim · 3
- PUKCHONGthreat actor · 3
- SentinelOneorganization · 2
- Applevendor · 2
- SentinelOnevendor · 2
- Zscalerorganization · 2
- GitHubvendor · 2
- macOSproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.