Jade Sleet Targets Indian IT Firm with FLATROOF and ROOFDECK Backdoors

• •Jade Sleet linked to breach of Indian IT services firm.
• •Attack utilized FLATROOF and ROOFDECK macOS backdoors.
• •Social engineering tactics involved job interview lures targeting developers.

North Korean threat actor Jade Sleet has been linked to the compromise of a small Indian IT services organization, focusing on developers to infiltrate networks. The attack utilized macOS backdoors known as FLATROOF and ROOFDECK, previously seen in Web3 sector attacks. The campaign involved social engineering tactics, using job interview lures to target individuals in DevOps and cryptocurrency roles. Attackers created fake GitHub repositories with malicious Terraform dependency lock files, leading to the deployment of the backdoors. FLATROOF communicates via Telegram and can exfiltrate browser data, while ROOFDECK uses the Nostr protocol for decentralized command and control. The compromise was detected in March 2026, with an updated ROOFDECK variant deployed later that month. The incident underscores the ongoing threat posed by state-sponsored actors targeting the IT sector.