Jade Sleet, a North Korea-aligned threat actor, has been linked by SentinelOne researchers to an intrusion involving an India-based IT services provider, where two macOS backdoors were discovered on a DevOps engineer’s Apple Silicon Mac.
SentinelOne identified the malware as FLATROOF and ROOFDECK. The activity overlaps with TraderTraitor, a DPRK-linked threat group also tracked under names including UNC4899, PUKCHONG and Jade Sleet.
The finding is notable because the affected organization was an IT services provider rather than a cryptocurrency company. According to SentinelOne Labs, the compromised endpoint belonged to a DevOps engineer using an Apple Silicon Mac.
Jade Sleet Linked to an Indian IT Services Provider
SentinelOne published its findings on September 18, 2026 after hunting for malware associated with earlier TraderTraitor activity.
Researchers identified an additional victim in India’s IT services sector and discovered FLATROOF and ROOFDECK artifacts on a DevOps engineer’s MacBook.
SentinelOne reported that both backdoors were present on the system by March 18, 2026. The researchers later observed activity associated with the implants, but the publicly available research does not establish the exact initial infection path for the Indian victim.
For broader context on state-backed cyber operations, see CyberUpdates365’s Nation-State Cyber Warfare and APT Threats 2026 hub.
The Initial Infection Method Is Still Unconfirmed
One of the most important distinctions in this incident is the difference between what SentinelOne directly observed on the Indian endpoint and what it documented across the wider TraderTraitor campaign.
SentinelOne has not publicly confirmed exactly how the Indian DevOps engineer was initially compromised.
The wider campaign has used developer-focused social engineering, malicious coding assignments and weaponized repositories. SentinelOne also documented Terraform-related delivery techniques elsewhere in the activity.
However, those broader techniques should not be presented as the proven infection vector for this specific Indian victim unless additional evidence becomes available.
Weaponized Terraform Repositories Used in the Wider Campaign
Although the Indian victim’s original delivery path remains unknown, SentinelOne documented malicious infrastructure-engineering repositories associated with the broader operation.
Observed repository names included:
- Northwind-IAC
- novacart-interview
- terraform-candidate-repo
SentinelOne found repositories containing manipulated .terraform.lock.hcl files that referenced attacker-controlled Terraform provider infrastructure.
The malicious provider domains documented by the researchers included:
registry.hashicorp-aws[.]comregistry.hashicorp-aws[.]ioregistry.hashicorp-terraform[.]io
Running terraform init in a maliciously prepared project could cause Terraform to retrieve the configured provider from attacker-controlled infrastructure, creating a path for malicious code execution.
This technique is particularly relevant to DevOps engineers because infrastructure-as-code repositories are routinely cloned, reviewed and initialized during development work, proof-of-concept testing and technical interviews.
More technical details on the campaign are available in the SentinelOne Labs investigation.
FLATROOF and ROOFDECK Target macOS Systems
SentinelOne identified two ARM64 macOS backdoors written in Rust: FLATROOF and ROOFDECK.
FLATROOF
FLATROOF is a macOS backdoor designed to give its operators remote access to an infected system.
SentinelOne’s research describes capabilities that include command execution, information collection and the deployment of additional payloads.
The researchers also observed FLATROOF interacting with ROOFDECK on the victim system, including actions intended to prepare the second payload for execution.
ROOFDECK
ROOFDECK is another Rust-based macOS backdoor associated with the same threat activity.
According to SentinelOne, it supports system reconnaissance, remote command execution, file operations and persistence-related functionality.
The two malware families had previously appeared during investigation of the LayerZero incident, helping researchers identify related activity on other systems.
Why DevOps Workstations Are High-Value Targets
A compromised DevOps laptop can provide attackers with access to much more than a single endpoint.
Engineering workstations commonly interact with:
- AWS, Microsoft Azure and Google Cloud environments
- GitHub, GitLab and other source-control platforms
- CI/CD pipelines
- Kubernetes clusters
- Terraform state and infrastructure configuration
- container registries
- deployment credentials
- API keys and service-account tokens
This concentration of access can make developer systems attractive targets for threat actors seeking a foothold into cloud infrastructure, source code or production environments.
The SentinelOne findings reinforce the need to treat developer and DevOps endpoints as privileged infrastructure rather than standard employee workstations.
Jade Sleet Has Previously Targeted Technology Employees
Jade Sleet has previously been associated with developer-focused social engineering.
In earlier research, GitHub Security documented activity in which attackers posed as developers or recruiters and approached employees of technology companies.
GitHub said the threat actors used platforms including LinkedIn, Slack and Telegram to establish contact with targets.
Victims could then be invited to collaborate on repositories and encouraged to clone or execute project content as part of a supposed development task.
GitHub also clarified that its own GitHub and npm infrastructure was not compromised in the campaign it investigated. The abuse involved attacker-controlled accounts, repositories and social-engineering techniques.
CyberUpdates365 has previously covered related activity in its report on North Korean cryptocurrency hackers and its analysis of North Korean hacker backdoor tools.
Connection to the LayerZero and KelpDAO Incident
The same FLATROOF and ROOFDECK malware families were previously identified during investigation of the 2026 LayerZero compromise.
According to LayerZero’s official incident report, the April 18, 2026 attack affecting the KelpDAO rsETH bridge resulted in losses of approximately $292 million.
The LayerZero report says incident-response findings connected the operation to the DPRK-linked TraderTraitor threat actor, also tracked as UNC4899.
LayerZero reported that social engineering against a developer played a role in the compromise and that stolen session material was used as attackers moved into its environment.
The new SentinelOne findings are significant because the Indian IT services provider was not a cryptocurrency company. This indicates that organizations outside the crypto sector can also encounter infrastructure and malware associated with TraderTraitor activity.
What DevOps and Security Teams Should Do
Organizations should not assume that a coding assignment, Terraform project or repository is trustworthy simply because it appears to come from a recruiter, customer or prospective employer.
Practical defensive measures include:
- review Terraform provider sources before initializing unfamiliar projects
- inspect
.terraform.lock.hclfiles for unexpected domains or provider namespaces - avoid executing untrusted interview projects directly on corporate workstations
- use isolated virtual machines, sandboxes or disposable development environments for unknown code
- prefer short-lived cloud credentials instead of long-lived static access keys
- apply least-privilege access to cloud, source-control and CI/CD systems
- monitor unusual child processes launched by IDEs and development tools
- monitor unexpected persistence mechanisms on macOS systems
- review which developer workstations can directly reach production environments
- separate development identities from highly privileged deployment identities where practical
Teams should also verify third-party Terraform providers carefully instead of assuming that a provider name or domain is legitimate because it visually resembles HashiCorp infrastructure.
CyberUpdates365 Analysis
The larger security issue in this campaign is the amount of privilege concentrated on modern engineering workstations.
A DevOps engineer may legitimately have access to source-code repositories, cloud consoles, build systems, Kubernetes clusters, infrastructure-as-code projects and deployment credentials from the same endpoint.
That means a successful compromise of one engineering machine can potentially offer an attacker several paths for further access.
The Terraform technique also highlights a software supply-chain problem that can be overlooked during manual review. Developers often inspect application source code closely but may pay less attention to provider metadata, lock files and infrastructure dependencies.
For security teams, the goal should be to reduce both sides of that risk: make untrusted development projects harder to execute on privileged systems and limit the blast radius if a developer endpoint is compromised.
What Remains Unknown
- The original infection vector for the Indian IT provider has not been publicly established.
- The identity of the affected Indian company has not been disclosed.
- The full scope of attacker access inside the organization is not publicly known.
- The available research does not establish that every weaponized Terraform repository resulted in a successful compromise.
These details should remain separate from confirmed findings unless SentinelOne, the affected organization or another authoritative source publishes additional evidence.
Official Sources
- SentinelOne Labs — TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
- GitHub Security — Jade Sleet Social Engineering Campaign
- LayerZero Labs — KelpDAO Incident Report
Bottom Line
SentinelOne’s investigation shows that Jade Sleet-linked malware associated with TraderTraitor activity has also appeared inside an Indian IT services provider.
The discovery of FLATROOF and ROOFDECK on a DevOps engineer’s Mac reinforces the security importance of developer endpoints, cloud identities and infrastructure-as-code workflows.
Organizations should treat externally supplied development projects as potentially untrusted code, verify infrastructure dependencies before execution and ensure that compromise of a single developer workstation cannot provide straightforward access to production systems.
