{"id":3014,"date":"2026-09-21T06:19:10","date_gmt":"2026-09-21T06:19:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3014"},"modified":"2026-09-21T06:19:10","modified_gmt":"2026-09-21T06:19:10","slug":"jade-sleet-linked-to-indian-it-provider-breach-with-flatroof-and-roofdeck-backdoors","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3014","title":{"rendered":"Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 21, 2026<\/span><\/span>Malware \/ Social Engineering<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The North Korean threat actor known as Jade Sleet<\/strong> has been attributed to the compromise of an India-based \u00abmuch smaller organization\u00bb in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks.<\/p>\n

Cybersecurity company SentinelOne, which disclosed<\/a> details of the activity, said it involved the use of Apple macOS backdoors tracked as FLATROOF (aka Gaslight) and ROOFDECK, both of which were previously observed in the March-April 2026 attack on KelpDAO’s LayerZero bridge<\/a>.<\/p>\n

Jade Sleet, also tracked under the monikers PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has a history of targeting the Web3 sector for cryptocurrency heists. In early 2025, the hacking group was tied<\/a> to the theft of about $1.5 billion from Bybit’s cold wallet infrastructure following a supply chain compromise of Safe{Wallet}’s developer environment.<\/p>\n

\u00abJade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms,\u00bb Microsoft-owned GitHub noted in July 2023.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

SentinelOne said the campaign employs social engineering using job interview lures, a common tactic adopted by multiple North Korean threat actors, to target job seekers from the companies that are breached over the course of the attack. Targeted individuals have been found to work in the DevOps, cryptocurrency, or financial technology space.<\/p>\n

<\/p>\n

\u00abThe GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as,\u00bb security researchers Albert Priego, Alex Delamotte, and Matej Havranek said.<\/p>\n

Some of the repositories observed are listed below –<\/p>\n