Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
SentinelOne attributed the compromise of a smaller India-based IT services provider to North Korean actor Jade Sleet, also known as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The campaign used job-interview GitHub lures and weaponized Terraform lockfiles to deliver the macOS backdoors FLATROOF, also called Gaslight, and ROOFDECK. FLATROOF uses Telegram for command-and-control and can steal browser, terminal, and keychain data; ROOFDECK uses Nostr and Launch Agents. The implants were present by March 18, 2026, and the same tooling was previously tied to the KelpDAO LayerZero incident.
76