"The backdoors were detected on the machine as early as March 18, 2026," SentinelOne reported — a detail that ties a recent India-based IT services compromise to a persistent campaign targeting developers and their toolchains. The activity, attributed to the North Korean-aligned threat actor known as Jade Sleet, again highlights a playbook that weaponizes developer workflows and supply-chain tooling to establish long-term access to high-value targets.
Jade Sleet's targeting and historical context
SentinelOne linked the intrusion at a "much smaller organization" in the information technology services sector to the actor tracked variously as Jade Sleet, PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The group has a documented focus on Web3 and cryptocurrency-related targets; Microsoft-owned GitHub observed in July 2023 that "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms." Past activity attributed to the group includes the early-2025 compromise of Safe{{Wallet}}'s developer environment and a subsequent Bybit cold-wallet theft of about $1.5 billion, underlining the financial stakes that motivate this actor.
FLATROOF and ROOFDECK: Rust-based backdoors for ARM macOS
SentinelOne said the campaign deployed two Rust-based implants built for ARM-based macOS systems: FLATROOF (aka Gaslight) and ROOFDECK. FLATROOF uses Telegram for command-and-control and supports command execution, file upload and download, and data theft through a Python module capable of collecting browser data (Chrome, Brave, Firefox, Safari), Terminal command histories, installed application lists, system hardware and software profiles, running-process snapshots, and a copy of login.keychain-db. ROOFDECK uses the decentralized Nostr protocol for C2 and provides system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents.
SentinelOne noted operational hygiene in ROOFDECK's design: "ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution. The command functionalities are separated into distinct handlers in the source code." An updated ROOFDECK variant deployed on April 20, 2026, removed symbols and debug information and uninstalled existing ROOFDECK and FLATROOF binaries — a step consistent with efforts to evade detection.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThe attack chain: developer lures and weaponized Terraform
At the center of the intrusion is a targeted social-engineering method that poses as job interview recruitment and delivers purpose-built development environments. SentinelOne and the researchers Albert Priego, Alex Delamotte, and Matej Havranek described GitHub repositories created as infrastructure-engineering project lures tailored to the companies being impersonated. Observed repository names include gtn-candidate-repo (used in the KelpDAO incident), Northwind-IAC, novacart-interview, and terraform-candidate-repo.
These repositories included a weaponized Terraform dependency lock file (".terraform.lock.hcl") that referenced malicious domains such as "registry.hashicorp-aws[.]com." When an unsuspecting developer ran "terraform init," the platform would download attacker-controlled modules, providing an initial foothold. SentinelOne's timeline shows the implants "were first launched by Cursor on March 29, seconds after the cloudshield workspace [~/DevOps-Automation/cloudshield] was opened," and that ROOFDECK was typically deployed as a follow-up tool after initial control was established.
Impact on the India-based IT provider and the infected DevOps endpoint
SentinelOne identified an unrelated IT services provider in India breached through an Apple Silicon MacBook belonging to a DevOps engineer. The backdoors were present on that machine by March 18, 2026, and "remained dormant until March 29, when beaconing and host activity began." Evidence indicates ROOFDECK was updated on April 20, 2026 — the day after LayerZero publicly acknowledged the KelpDAO hack — suggesting coordination in tooling updates across multiple operations tied to the same actor.
The researchers emphasized that developer endpoints are attractive targets because they hold keys to cloud environments, pipelines, and source code. SentinelOne warned these campaigns use individualized, purpose-built development environments paired with backdoored Terraform builds that differ for each victim, effectively targeting one engineer at a time.
What this means for developers, security teams, and procurement leaders
- Developers and DevOps engineers: Treat external repositories and candidate code with the same suspicion applied to third-party packages; running "terraform init" against unfamiliar modules can download and execute attacker-controlled components.
- Security teams and incident responders: Monitor developer workspaces and macOS endpoints used for development for dormant implants and unusual beaconing patterns; expect adversaries to use Telegram and decentralized protocols like Nostr for C2 and to remove debug symbols to hinder detection.
- Procurement and vendor managers: Recognize that targeting of vendors and smaller service providers can cascade to larger customers; vet the security of developer environments and require controls on dependency sources and build processes.
SentinelOne's findings close a loop between previous high-profile Web3 compromises and a technique set that focuses on the human and tooling vectors of development work. The facts in the record — malicious Terraform lock files, interview-themed GitHub lures, Rust implants for Apple Silicon, and precise timestamps from mid-March to April 2026 — describe a campaign that is surgical in scope and persistent in method. The remaining questions are operational: which organizations will harden build and recruitment workflows next, and whether these tactics will migrate beyond crypto-adjacent targets.
