Jade Sleet's macOS backdoors hit IT vendor

A DevOps engineer's Apple Silicon MacBook became the foothold for a North Korean intrusion that used two Rust-based macOS backdoors, according to SentinelOne, which attributed the activity to the threat actor it calls Jade Sleet. The incident at an India-based information technology services provider shows how an adversary tied to cryptocurrency theft keeps finding its way in through developer workstations rather than through the networks it ultimately wants to reach.

An IT provider caught in the hunt

SentinelOne disclosed that its search for two known macOS implants turned up a second, unrelated victim: an IT services provider based in India that the researchers describe as a "much smaller organization." The company was compromised through an Apple Silicon MacBook belonging to a DevOps engineer.

The activity was attributed to Jade Sleet, a North Korean threat actor also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The group is known for going after the Web3 sector to fund cryptocurrency heists, but this victim sits in IT services rather than blockchain or finance, which put it outside the actor's usual target profile.

The two backdoors found on the machine, tracked as FLATROOF and ROOFDECK, had been seen before. Both appeared in the March-April 2026 attack on KelpDAO's LayerZero bridge, tying the earlier campaign to this newer victim through shared tooling.

Two backdoors built for macOS

SentinelOne described FLATROOF, also known as Gaslight, as a backdoor that relies on Telegram for command-and-control. It can execute commands, upload and download files, and steal data through a Python module able to harvest browser data from Chrome, Brave, Firefox, and Safari, along with Terminal command histories, installed application listings, system hardware and software profiles, a snapshot of running processes, and a copy of login.keychain-db.

ROOFDECK takes a different route for its infrastructure, using the Nostr protocol for decentralized command-and-control. Its capabilities include system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence established through Launch Agents.

The researchers noted that ROOFDECK's commands are signed with the operator's private key and verified against an embedded public key before they run, with functionality split across distinct handlers in the source code. They also observed that the implant reimplements many common shell commands for directory and file operations, a design choice they compared to other sophisticated North Korea-aligned toolsets, including Lazarus' LightlessCan.

How the repositories pull developers in

The campaign uses social engineering built around job interview lures, a technique SentinelOne says is common among multiple North Korean threat actors. The targets are job seekers at companies the actor later breaches, and the individuals singled out have been found working in DevOps, cryptocurrency, or financial technology roles.

SentinelOne researchers Albert Priego, Alex Delamotte, and Matej Havranek described how the coding-project lures are dressed up to look plausible. "The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as," they said.

Several such repositories were observed in the activity, including gtn-candidate-repo, which was used in the KelpDAO incident, along with Northwind-IAC, novacart-interview, and terraform-candidate-repo.

Each repository carries a weaponized Terraform dependency lock file, .terraform.lock.hcl, that points to malicious domains such as registry.hashicorp-aws[.]com. When an unsuspecting developer runs the terraform init command, the platform pulls attacker-controlled modules from that infrastructure, completing the delivery step without any obvious red flag in the project itself.

A dormant install, then a sudden wake-up

On the Indian IT provider's compromised MacBook, the backdoors were detected on the system as early as March 18, 2026, though SentinelOne said the exact delivery mechanism remains unknown. The implants then sat quiet for days.

"They remained dormant until March 29, when beaconing and host activity began," the researchers said. "The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace [~/DevOps-Automation/cloudshield] was opened."

Evidence from the investigation indicates ROOFDECK is deployed as a follow-up tool on hosts that are already compromised, arriving only after an initial foothold and control channel have been established. That sequencing suggests the operator uses the second implant to extend reach or capability once access is confirmed.

An updated implant after KelpDAO went public

Timing in the intrusion is notable. An updated version of ROOFDECK was deployed on the DevOps engineer's system on April 20, 2026, a day after LayerZero publicly acknowledged the KelpDAO hack. The new variant removed the existing ROOFDECK and FLATROOF binaries and stripped symbols and debug information, steps SentinelOne characterized as attempts to evade detection.

The connection between the IT provider compromise and the KelpDAO bridge attack runs through the malware itself. KelpDAO's LayerZero bridge was the target of the earlier operation, and the same FLATROOF and ROOFDECK families resurfaced on the Indian victim's machine.

Jade Sleet's history includes a run of intrusions against Web3 organizations. In early 2025, the group was tied to the theft of about $1.5 billion from Bybit's cold wallet infrastructure after a supply chain compromise of Safe{Wallet}'s developer environment.

Why developer machines stay in the crosshairs

SentinelOne's account places the developer endpoint at the center of the defensive problem. "These groups' initial access efforts include targeting third parties and their software supply chain, which is where much of the industry's exposure has moved, putting the developer endpoint at the center of the defense," the company said.

The same statement points to what makes those endpoints valuable once reached. "Endpoints used for development carry access to cloud, pipelines and source code, which makes monitoring and protection a high priority for organizations," the researchers said. "These campaigns use purpose-built development environments aimed at one engineer at a time, paired with backdoored Terraform builds that differ for each victim."

That per-victim customization is a recurring feature of the activity, with repositories and lures shaped around the company the actor is impersonating rather than reused wholesale across targets. SentinelOne's hunt for FLATROOF and ROOFDECK produced the Indian IT services victim as an additional find, separate from the KelpDAO-related activity.

What the incident leaves unresolved

Several elements of the Indian IT provider compromise remain open. SentinelOne could not determine how the backdoors first arrived on the MacBook, only that they were present by March 18, 2026, and that they began beaconing on March 29. The initial delivery vector for that specific host therefore stays unidentified in the published findings.

What is documented is the toolset, the timing, and the target profile. Two Rust-based macOS backdoors built for ARM systems, one using Telegram for control and the other the Nostr protocol, were found on a machine belonging to an engineer at a company that is not a cryptocurrency or blockchain firm. The actor, per SentinelOne's attribution, is the same one behind prior Web3 intrusions.

GitHub, owned by Microsoft, offered an earlier characterization of the group's targeting in July 2023. "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms," it noted.

The takeaways for security teams

For organizations, the case reinforces a pattern in which the entry point is not the crown-jewel system but a laptop used for development work. That machine holds credentials and access that reach cloud environments, build pipelines, and source code, which is why SentinelOne frames monitoring and protection of developer endpoints as a high priority. A candidate repository, an interview coding exercise, or a Terraform project that looks ordinary can carry a dependency lock file pointing somewhere else entirely.

The data-harvesting capability of FLATROOF matters here as well. Its Python module reaches into Chrome, Brave, Firefox, and Safari, Terminal histories, application lists, system profiles, running processes, and the login keychain. For a business, that is a collection of secrets and session material concentrated on one device. This suggests that an engineering workstation deserves the same scrutiny as a server, particularly when it sits behind a third-party or supply chain relationship that an attacker can exploit. The fact that this victim was a smaller IT services provider rather than a blockchain company also indicates the targeting is broader than the actor's public reputation would imply.