[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feg8-jWQAd8oji7c9U05MQYnJ16Hug6gugpwjVuhL5ck":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50},"45be79b5-95ea-44ba-8706-3a7c35e0d438","north-korean-jade-sleet-backdoors-indian-it-provider-via-macos-malware","19ee6fb5-7ef3-46c9-803d-dbb08787c4be","North Korean Jade Sleet Backdoors Indian IT Provider via macOS Malware","Jade Sleet, a North Korean state-sponsored threat actor, compromised an Indian IT services company using sophisticated macOS backdoors (FLATROOF and ROOFDECK), continuing a pattern of targeting developers and technology supply chains. The breach highlights how attackers leverage trusted IT vendors as pivot points to reach downstream clients, including high-value targets in the Web3 and cryptocurrency sectors. By focusing on developers and IT service providers, adversaries can implant malware that propagates through legitimate software delivery pipelines. This matters because a single compromised IT provider can expose dozens or hundreds of client organizations to nation-state level threats.","**Immediate actions:**\n- Audit and verify the integrity of all third-party IT service provider access credentials and revoke any that are unnecessary or overly permissive.\n- Deploy endpoint detection and response (EDR) tools capable of identifying macOS-specific backdoor behaviors such as those exhibited by FLATROOF and ROOFDECK.\n\n**Long-term improvements:**\n- Implement a formal third-party vendor risk management program that includes regular security assessments and contractual security requirements for all IT service providers.\n- Enforce strict software supply chain controls, including code signing, binary integrity verification, and allowlisting for developer environments.\n- Apply the principle of least privilege across all developer and IT service provider accounts to limit lateral movement in the event of a compromise.\n\n**Detection measures:**\n- Enable centralized logging and behavioral monitoring for macOS endpoints, with alerts tuned for anomalous persistence mechanisms and outbound command-and-control traffic.\n- Integrate threat intelligence feeds covering North Korean APT indicators (including Jade Sleet TTPs) into your SIEM to enable rapid detection of known malware signatures and infrastructure.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity is monitored","NIST CSF ID.SC-2: Suppliers and third-party partners assessed for risk","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1543: Create or Modify System Process (Persistence)","ISO\u002FIEC 27036: Information Security for Supplier Relationships","published","2026-09-21T08:20:38.192999+00:00","2026-09-21T08:20:38.082+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fjade-sleet-linked-to-indian-it-provider.html","jade-sleet-linked-to-indian-it-provider-breach-with-flatroof-and-roofdeck-backdo-7de863","Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[]]