Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
North Korean threat actor Jade Sleet linked to Indian IT provider breach using macOS backdoors.
The North Korean threat actor Jade Sleet has been linked to a breach of an Indian IT services company, continuing its pattern of targeting developers. The attack involved the use of macOS backdoors, FLATROOF and ROOFDECK, previously seen in attacks on the Web3 sector. Jade Sleet, also known by other aliases, has a history of cryptocurrency heists and supply chain compromises.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SentinelOne?
Get an email when a new story names SentinelOne, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonJade Sleet, a North Korean state-sponsored threat actor, compromised an Indian IT services company using sophisticated macOS backdoors (FLATROOF and ROOFDECK), continuing a pattern of targeting developers and technology supply chains. The breach highlights how attackers leverage trusted IT vendors as pivot points to reach downstream clients, including high-value targets in the Web3 and cryptocurrency sectors. By focusing on developers and IT service providers, adversaries can implant malware that propagates through legitimate software delivery pipelines. This matters because a single compromised IT provider can expose dozens or hundreds of client organizations to nation-state level threats.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FLATROOF
- malware — ROOFDECK
- domain — registry.hashicorp-aws[.]com
- mitre_attack — T1059
- mitre_attack — T1071
- mitre_attack — T1105
- mitre_attack — T1041
- mitre_attack — T1047
- mitre_attack — T1547
- mitre_attack — T1560