As reported by The Hacker News, SentinelOne has attributed another compromise to North Korea's Jade Sleet (aka PUKCHONG, Slow Pisces, TraderTraitor), this time targeting a smaller India-based IT services provider using macOS backdoors FLATROOF and ROOFDECK. While the technical details matter, the strategic pattern matters more: Jade Sleet is not simply targeting crypto companies directly. They're targeting the connective tissue — IT service vendors, DevOps contractors, and infrastructure engineers who hold trusted access into multiple downstream organizations.

Threat Intelligence: As reported by The Hacker News, SentinelOne has attributed another compromise to North Korea's Jade Sleet (aka PUKCHONG, Slow Pisces, TraderTraitor), this time targeting a smaller India-based IT services provider using macOS backdoors FLATROOF and ROOFDECK.

Why the Third-Party Vector Matters

This campaign illustrates a classic supply chain compromise pattern adapted for the Web3 era. Jade Sleet understands that breaching a hardened crypto exchange or DeFi protocol directly is difficult. Breaching the outsourced DevOps engineer who has committed SSH keys to a production environment is far easier. The Indian IT provider — described as "much smaller" — was likely not the end goal but a stepping stone.

The threat actor doesn't need your crown jewels directly. They need someone with legitimate access to your environment who can be socially engineered into running terraform init against a weaponized dependency.

The Terraform Lock File Technique Deserves Attention

What makes this campaign technically notable is the abuse of .terraform.lock.hcl files pointing to attacker-controlled module registries using typosquatted domains like registry.hashicorp-aws[.]com. This is a subtle but effective technique that bypasses typical developer scrutiny because:

Why the Third-Party Vector Matters
Lock files are normally trusted artifacts, not something developers inspect manually
The malicious domain closely mimics HashiCorp's legitimate registry
The terraform init command is a routine, low-friction action that developers run without hesitation during coding assessments

FLATROOF and ROOFDECK: Purpose-Built for macOS Developer Targets

Both backdoors are Rust-based and target ARM-based macOS systems — the platform of choice for many developers and engineers in the crypto space. FLATROOF's use of Telegram for C2 is notable for blending into legitimate traffic, while ROOFDECK's Nostr-based C2 leverages decentralized protocols that are harder to take down. The browser data exfiltration capability — covering Chrome, Brave, Firefox, and Safari — combined with access to login.keychain-db gives attackers a direct path to session tokens, SSH keys, and cloud provider credentials stored in password managers.

Who Is at Risk

Organizations most exposed to this threat pattern include:

  • Cryptocurrency exchanges, DeFi protocols, and Web3 startups using outsourced DevOps talent
  • Fintech companies with distributed engineering teams across South and Southeast Asia
  • IT services providers whose employees handle infrastructure-as-code for multiple client environments
  • Any organization whose developers use GitHub repositories from unverified sources as part of interview processes

Shield53 Recommendations

Immediate Actions

  • Audit Terraform lock files: Implement automated scanning of .terraform.lock.hcl files across all repositories. Flag any module sources pointing to non-HashiCorp domains or typosquatted variants.
  • Restrict developer browsing of untrusted repos: Disable direct terraform init execution from candidate assessment repositories. Use isolated development environments or CI/CD pipelines for any untrusted code execution.
  • Harden macOS developer endpoints: Deploy EDR with specific detection rules for Telegram API traffic from non-browser processes and Nostr protocol connections from unexpected applications.
  • Protect keychain and browser data: Enforce keychain locking policies, restrict keychain access for non-essential applications, and consider browser session isolation for developers handling production credentials.

Strategic Recommendations

  • Vet third-party IT providers: Require security attestations from outsourced DevOps and infrastructure contractors, specifically covering macOS endpoint protection and credential hygiene practices.
  • Implement just-in-time access: Replace standing SSH keys and cloud credentials with time-bound, auditable access for contractors and service providers.
  • Monitor for Jade Sleet IOCs: Review SentinelOne's threat intelligence for FLATROOF and ROOFDECK indicators, including the identified GitHub repositories (gtn-candidate-repo, Northwind-IAC, novacart-interview, terraform-candidate-repo) and typosquatted registry domains.
  • Brief hiring managers and recruiters: The social engineering entry point is the job interview process. Ensure HR and technical hiring teams understand that coding assessments involving external repositories are a known DPRK attack vector.

The broader implication is clear: North Korean threat actors have industrialized the targeting of developer trust. Every outsourced engineering relationship, every coding assessment involving external repositories, and every contractor with infrastructure access is now a potential attack surface. Organizations that treat this as a perimeter problem rather than a supply chain trust problem will continue to be compromised.