Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Summary: SentinelOne attributed a breach of a smaller India-based IT services organization to North Korean actor Jade Sleet, using macOS backdoors FLATROOF and ROOFDECK previously seen in the March-April 2026 KelpDAO LayerZero bridge attack. The backdoors were detected on an Apple Silicon MacBook belonging to a DevOps engineer as early as March 18, 2026, stayed dormant until beaconing began March 29 when Cursor launched them seconds after the cloudshield workspace was opened, and an updated ROOFDECK was deployed April 20, 2026, a day after LayerZero publicly acknowledged the KelpDAO hack.
What you should know: The intrusion ran through a weaponized Terraform lock file pulling modules from a lookalike domain and a developer endpoint holding access to cloud, pipelines and source code - and the same actor was tied to the roughly $1.5 billion Bybit cold wallet theft in early 2025.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026